Re: [PATCH v15 03/23] powerpc/kexec_file: Fix NULL pointer dereference in kexec_extra_fdt_size_ppc64()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] FDT Buffer Under-allocation due to logic error in kexec_extra_fdt_size_ppc64()
--

commit 78687759639490ab63d0d6924f151d698ff15bbc
Author: Jinjie Ruan <ruanjinjie@huawei.com>

powerpc/kexec_file: Fix NULL pointer dereference in kexec_extra_fdt_size_ppc64()

This commit adds an early return to kexec_extra_fdt_size_ppc64() to prevent
a NULL pointer dereference if the rmem pointer is not allocated.

> diff --git a/arch/powerpc/kexec/file_load_64.c b/arch/powerpc/kexec/file_load_64.c
> index 8c72e12ea44e5..fdeedf102c38e 100644
> --- a/arch/powerpc/kexec/file_load_64.c
> +++ b/arch/powerpc/kexec/file_load_64.c
> @@ -649,6 +649,9 @@ unsigned int kexec_extra_fdt_size_ppc64(struct kimage *image, struct crash_mem *
>  	struct device_node *dn;
>  	unsigned int cpu_nodes = 0, extra_size = 0;
>  
> +	if (!rmem)
> +		return 0;
> +

[Severity: High]
Does this early return improperly short-circuit the rest of the FDT extra
size calculation for independent components when no reserved memory regions
are present?

The get_reserved_memory_ranges() function can legitimately return 0 with a
NULL rmem on platforms lacking reserved memory regions. Returning 0 here
entirely bypasses other size estimations, such as plpks passwords,
hotplugged CPU nodes, and especially kdump_extra_fdt_size_ppc64().

Because kdump_extra_fdt_size_ppc64() calculates linux,drconf-usable-memory
entries which can exceed 32KB on systems with large hotpluggable memory
configurations, the baseline 4KB extra space cannot accommodate this missing
size. This could lead to FDT setup failing with -FDT_ERR_NOSPACE during
setup_new_fdt_ppc64() and prevent kexec/kdump from successfully loading.

Would it be better to conditionally guard only the rmem->nr_ranges access
further down in the function instead of returning early?

>  	// Budget some space for the password blob. There's already extra space
>  	// for the key name
>  	if (plpks_is_available())

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260601094805.2928614-1-ruanjinjie@huawei.com?part=3