[PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Tao Liu]

A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
where image->segment[i].buf might be NULL and copied unchecked.

The NULL buf comes from security/integrity/ima/ima_kexec.c:
ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(),
but kbuf.buffer is NULL.

Fix this by simply adding a check before copy.

Signed-off-by: Tao Liu <ltao@redhat.com>
---
 arch/riscv/kernel/machine_kexec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
index 2306ce3e5f22..d81d576f9cb5 100644
--- a/arch/riscv/kernel/machine_kexec.c
+++ b/arch/riscv/kernel/machine_kexec.c
@@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
 		if (image->segment[i].memsz <= sizeof(fdt))
 			continue;
 
+		if (image->segment[i].buf == NULL)
+			continue;
+
 		if (image->file_mode)
 			memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
 		else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
-- 
2.47.0


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Tao Liu]

Kindly ping, any comments?

Thanks,
Tao Liu

On Fri, May 29, 2026 at 3:35 PM Tao Liu <ltao@redhat.com> wrote:
>
> A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
> where image->segment[i].buf might be NULL and copied unchecked.
>
> The NULL buf comes from security/integrity/ima/ima_kexec.c:
> ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(),
> but kbuf.buffer is NULL.
>
> Fix this by simply adding a check before copy.
>
> Signed-off-by: Tao Liu <ltao@redhat.com>
> ---
>  arch/riscv/kernel/machine_kexec.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
> index 2306ce3e5f22..d81d576f9cb5 100644
> --- a/arch/riscv/kernel/machine_kexec.c
> +++ b/arch/riscv/kernel/machine_kexec.c
> @@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
>                 if (image->segment[i].memsz <= sizeof(fdt))
>                         continue;
>
> +               if (image->segment[i].buf == NULL)
> +                       continue;
> +
>                 if (image->file_mode)
>                         memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
>                 else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
> --
> 2.47.0
>


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Baoquan He]

Add kexec ML to CC.

On Fri, Jun 26, 2026 at 7:46 AM Tao Liu <ltao@redhat.com> wrote:
>
> Kindly ping, any comments?
>
> Thanks,
> Tao Liu
>
> On Fri, May 29, 2026 at 3:35 PM Tao Liu <ltao@redhat.com> wrote:
> >
> > A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
> > where image->segment[i].buf might be NULL and copied unchecked.
> >
> > The NULL buf comes from security/integrity/ima/ima_kexec.c:
> > ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(),
> > but kbuf.buffer is NULL.
> >
> > Fix this by simply adding a check before copy.
> >
> > Signed-off-by: Tao Liu <ltao@redhat.com>
> > ---
> >  arch/riscv/kernel/machine_kexec.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
> > index 2306ce3e5f22..d81d576f9cb5 100644
> > --- a/arch/riscv/kernel/machine_kexec.c
> > +++ b/arch/riscv/kernel/machine_kexec.c
> > @@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
> >                 if (image->segment[i].memsz <= sizeof(fdt))
> >                         continue;
> >
> > +               if (image->segment[i].buf == NULL)
> > +                       continue;
> > +

This is a good fix, maybe we can add code comments to explain it as
below, just for reference.

               /*
                * Some segments (e.g. IMA) reserve space but have no buffer
                * loaded yet. Skip them as they cannot contain an FDT.
                */
And is there any other place where the similar issue exists? e.g on LoongArch?

Other than above concerns, this patch looks good to me:

Acked-by: Baoquan He <bhe@redhat.com>

> >                 if (image->file_mode)
> >                         memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
> >                 else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
> > --
> > 2.47.0
> >
>
>
> _______________________________________________
> linux-riscv mailing list
> linux-riscv@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-riscv
>


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Tao Liu]

Hi Baoquan,

Glad to see your message again!

Thanks for the Ack and the suggestion for the comment, I will add it
in the next version.

In the meantime, I will check if similar issue exists on LoongArch as well.

Thanks,
Tao Liu

On Fri, Jun 26, 2026 at 8:04 PM Baoquan He <bhe@redhat.com> wrote:
>
> Add kexec ML to CC.
>
> On Fri, Jun 26, 2026 at 7:46 AM Tao Liu <ltao@redhat.com> wrote:
> >
> > Kindly ping, any comments?
> >
> > Thanks,
> > Tao Liu
> >
> > On Fri, May 29, 2026 at 3:35 PM Tao Liu <ltao@redhat.com> wrote:
> > >
> > > A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
> > > where image->segment[i].buf might be NULL and copied unchecked.
> > >
> > > The NULL buf comes from security/integrity/ima/ima_kexec.c:
> > > ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(),
> > > but kbuf.buffer is NULL.
> > >
> > > Fix this by simply adding a check before copy.
> > >
> > > Signed-off-by: Tao Liu <ltao@redhat.com>
> > > ---
> > >  arch/riscv/kernel/machine_kexec.c | 3 +++
> > >  1 file changed, 3 insertions(+)
> > >
> > > diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
> > > index 2306ce3e5f22..d81d576f9cb5 100644
> > > --- a/arch/riscv/kernel/machine_kexec.c
> > > +++ b/arch/riscv/kernel/machine_kexec.c
> > > @@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
> > >                 if (image->segment[i].memsz <= sizeof(fdt))
> > >                         continue;
> > >
> > > +               if (image->segment[i].buf == NULL)
> > > +                       continue;
> > > +
>
> This is a good fix, maybe we can add code comments to explain it as
> below, just for reference.
>
>                /*
>                 * Some segments (e.g. IMA) reserve space but have no buffer
>                 * loaded yet. Skip them as they cannot contain an FDT.
>                 */
> And is there any other place where the similar issue exists? e.g on LoongArch?
>
> Other than above concerns, this patch looks good to me:
>
> Acked-by: Baoquan He <bhe@redhat.com>
>
> > >                 if (image->file_mode)
> > >                         memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
> > >                 else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
> > > --
> > > 2.47.0
> > >
> >
> >
> > _______________________________________________
> > linux-riscv mailing list
> > linux-riscv@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/linux-riscv
> >
>


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Tao Liu]

Hi Baoquan,

On Fri, Jun 26, 2026 at 8:38 PM Tao Liu <ltao@redhat.com> wrote:
>
> Hi Baoquan,
>
> Glad to see your message again!
>
> Thanks for the Ack and the suggestion for the comment, I will add it
> in the next version.
>
> In the meantime, I will check if similar issue exists on LoongArch as well.
>
> Thanks,
> Tao Liu
>
> On Fri, Jun 26, 2026 at 8:04 PM Baoquan He <bhe@redhat.com> wrote:
> >
> > Add kexec ML to CC.
> >
> > On Fri, Jun 26, 2026 at 7:46 AM Tao Liu <ltao@redhat.com> wrote:
> > >
> > > Kindly ping, any comments?
> > >
> > > Thanks,
> > > Tao Liu
> > >
> > > On Fri, May 29, 2026 at 3:35 PM Tao Liu <ltao@redhat.com> wrote:
> > > >
> > > > A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
> > > > where image->segment[i].buf might be NULL and copied unchecked.
> > > >
> > > > The NULL buf comes from security/integrity/ima/ima_kexec.c:
> > > > ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(),
> > > > but kbuf.buffer is NULL.
> > > >
> > > > Fix this by simply adding a check before copy.
> > > >
> > > > Signed-off-by: Tao Liu <ltao@redhat.com>
> > > > ---
> > > >  arch/riscv/kernel/machine_kexec.c | 3 +++
> > > >  1 file changed, 3 insertions(+)
> > > >
> > > > diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
> > > > index 2306ce3e5f22..d81d576f9cb5 100644
> > > > --- a/arch/riscv/kernel/machine_kexec.c
> > > > +++ b/arch/riscv/kernel/machine_kexec.c
> > > > @@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
> > > >                 if (image->segment[i].memsz <= sizeof(fdt))
> > > >                         continue;
> > > >
> > > > +               if (image->segment[i].buf == NULL)
> > > > +                       continue;
> > > > +
> >
> > This is a good fix, maybe we can add code comments to explain it as
> > below, just for reference.
> >
> >                /*
> >                 * Some segments (e.g. IMA) reserve space but have no buffer
> >                 * loaded yet. Skip them as they cannot contain an FDT.
> >                 */
> > And is there any other place where the similar issue exists? e.g on LoongArch?

I have tested in LoongArch, it doesn't have the similar issue. The
reason is, in arch/loongarch/kernel/machine_kexec.c:machine_kexec_prepare(),
the unchecked memcpy() only happens for none kexec file load, however
ima_add_kexec_buffer() requires kexec file load. So the condition
isn't met.

> >
> > Other than above concerns, this patch looks good to me:
> >
> > Acked-by: Baoquan He <bhe@redhat.com>

Thanks for your code review and suggestions!

Thanks,
Tao Liu

> >
> > > >                 if (image->file_mode)
> > > >                         memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
> > > >                 else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
> > > > --
> > > > 2.47.0
> > > >
> > >
> > >
> > > _______________________________________________
> > > linux-riscv mailing list
> > > linux-riscv@lists.infradead.org
> > > http://lists.infradead.org/mailman/listinfo/linux-riscv
> > >
> >


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Baoquan He]

On 06/28/26 at 10:38am, Tao Liu wrote:
......
> > >                /*
> > >                 * Some segments (e.g. IMA) reserve space but have no buffer
> > >                 * loaded yet. Skip them as they cannot contain an FDT.
> > >                 */
> > > And is there any other place where the similar issue exists? e.g on LoongArch?
> 
> I have tested in LoongArch, it doesn't have the similar issue. The
> reason is, in arch/loongarch/kernel/machine_kexec.c:machine_kexec_prepare(),
> the unchecked memcpy() only happens for none kexec file load, however
> ima_add_kexec_buffer() requires kexec file load. So the condition
> isn't met.

OK, that's good, thanks for the effort.

> 
> > >
> > > Other than above concerns, this patch looks good to me:
> > >
> > > Acked-by: Baoquan He <bhe@redhat.com>
> 
> Thanks for your code review and suggestions!
> 
> Thanks,
> Tao Liu
> 
> > >
> > > > >                 if (image->file_mode)
> > > > >                         memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
> > > > >                 else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
> > > > > --
> > > > > 2.47.0
> > > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > linux-riscv mailing list
> > > > linux-riscv@lists.infradead.org
> > > > http://lists.infradead.org/mailman/listinfo/linux-riscv
> > > >
> > >
> 

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Pratyush Yadav]

+Cc IMA maintainers

On Fri, Jun 26 2026, Baoquan He wrote:

> Add kexec ML to CC.
>
> On Fri, Jun 26, 2026 at 7:46 AM Tao Liu <ltao@redhat.com> wrote:
>>
>> Kindly ping, any comments?
>>
>> Thanks,
>> Tao Liu
>>
>> On Fri, May 29, 2026 at 3:35 PM Tao Liu <ltao@redhat.com> wrote:
>> >
>> > A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
>> > where image->segment[i].buf might be NULL and copied unchecked.
>> >
>> > The NULL buf comes from security/integrity/ima/ima_kexec.c:
>> > ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(),
>> > but kbuf.buffer is NULL.
>> >
>> > Fix this by simply adding a check before copy.
>> >
>> > Signed-off-by: Tao Liu <ltao@redhat.com>
>> > ---
>> >  arch/riscv/kernel/machine_kexec.c | 3 +++
>> >  1 file changed, 3 insertions(+)
>> >
>> > diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
>> > index 2306ce3e5f22..d81d576f9cb5 100644
>> > --- a/arch/riscv/kernel/machine_kexec.c
>> > +++ b/arch/riscv/kernel/machine_kexec.c
>> > @@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
>> >                 if (image->segment[i].memsz <= sizeof(fdt))
>> >                         continue;
>> >
>> > +               if (image->segment[i].buf == NULL)
>> > +                       continue;
>> > +
>
> This is a good fix, maybe we can add code comments to explain it as
> below, just for reference.
>
>                /*
>                 * Some segments (e.g. IMA) reserve space but have no buffer
>                 * loaded yet. Skip them as they cannot contain an FDT.
>                 */
> And is there any other place where the similar issue exists? e.g on LoongArch?
>
> Other than above concerns, this patch looks good to me:
>
> Acked-by: Baoquan He <bhe@redhat.com>

Yeah, the patch LGTM to me too.

Acked-by: Pratyush Yadav <pratyush@kernel.org>

Although I think IMA can make this a bit easier to understand. First, in
ima_add_kexec_buffer() it should set kbuf.buffer to NULL and kbuf.bufsz
to 0 explicitly instead of using kexec_buffer and kexec_buffer_size
which are initialized to NULL and 0, but never updated. Using the
variables here adds an extra level of indirection.

Also, perhaps we should add a comment in ima_add_kexec_buffer() about
how this all works, since where the IMA buffer lives and where it gets
updated it fairly complicated and took me some time to piece together.

-- 
Regards,
Pratyush Yadav

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Markus Elfring]

> A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
…
                 dereference?


…
> Fix this by simply adding a check before copy.

How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?

See also:
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc1#n145
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2-rc1#n34


Regards,
Markus

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Tao Liu]

Hi Markus,

On Tue, Jun 30, 2026 at 1:00 AM Markus Elfring <Markus.Elfring@web.de> wrote:
>
> > A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
> …
>                  dereference?
>
>
> …
> > Fix this by simply adding a check before copy.
>
> How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?

Right, thanks for the suggestion. I will improve the commit message
wording in v3.

Thanks,
Tao Liu

>
> See also:
> * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc1#n145
> * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2-rc1#n34
>
>
> Regards,
> Markus
>


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Tao Liu]

Hi Pratyush,

On Mon, Jun 29, 2026 at 11:13 PM Pratyush Yadav <pratyush@kernel.org> wrote:
>
> +Cc IMA maintainers
>
> On Fri, Jun 26 2026, Baoquan He wrote:
>
> > Add kexec ML to CC.
> >
> > On Fri, Jun 26, 2026 at 7:46 AM Tao Liu <ltao@redhat.com> wrote:
> >>
> >> Kindly ping, any comments?
> >>
> >> Thanks,
> >> Tao Liu
> >>
> >> On Fri, May 29, 2026 at 3:35 PM Tao Liu <ltao@redhat.com> wrote:
> >> >
> >> > A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
> >> > where image->segment[i].buf might be NULL and copied unchecked.
> >> >
> >> > The NULL buf comes from security/integrity/ima/ima_kexec.c:
> >> > ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(),
> >> > but kbuf.buffer is NULL.
> >> >
> >> > Fix this by simply adding a check before copy.
> >> >
> >> > Signed-off-by: Tao Liu <ltao@redhat.com>
> >> > ---
> >> >  arch/riscv/kernel/machine_kexec.c | 3 +++
> >> >  1 file changed, 3 insertions(+)
> >> >
> >> > diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
> >> > index 2306ce3e5f22..d81d576f9cb5 100644
> >> > --- a/arch/riscv/kernel/machine_kexec.c
> >> > +++ b/arch/riscv/kernel/machine_kexec.c
> >> > @@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
> >> >                 if (image->segment[i].memsz <= sizeof(fdt))
> >> >                         continue;
> >> >
> >> > +               if (image->segment[i].buf == NULL)
> >> > +                       continue;
> >> > +
> >
> > This is a good fix, maybe we can add code comments to explain it as
> > below, just for reference.
> >
> >                /*
> >                 * Some segments (e.g. IMA) reserve space but have no buffer
> >                 * loaded yet. Skip them as they cannot contain an FDT.
> >                 */
> > And is there any other place where the similar issue exists? e.g on LoongArch?
> >
> > Other than above concerns, this patch looks good to me:
> >
> > Acked-by: Baoquan He <bhe@redhat.com>
>
> Yeah, the patch LGTM to me too.
>
> Acked-by: Pratyush Yadav <pratyush@kernel.org>
>
> Although I think IMA can make this a bit easier to understand. First, in
> ima_add_kexec_buffer() it should set kbuf.buffer to NULL and kbuf.bufsz
> to 0 explicitly instead of using kexec_buffer and kexec_buffer_size
> which are initialized to NULL and 0, but never updated. Using the
> variables here adds an extra level of indirection.
>
> Also, perhaps we should add a comment in ima_add_kexec_buffer() about
> how this all works, since where the IMA buffer lives and where it gets
> updated it fairly complicated and took me some time to piece together.

Thanks for your patch review and suggestions! I agree with your point
on the IMA part, I was confused by the code too, e.g in
ima_add_kexec_buffer():

void *kexec_buffer = NULL;
kbuf.buffer = kexec_buffer;
ret = kexec_add_buffer(&kbuf);
if (ret) {
    pr_err("Error passing over kexec measurement buffer.\n");
    vfree(kexec_buffer);
    return;
}

Do we need to vfree(kexec_buffer)? When kexec_buffer is NULL and seems
never get updated.

I'm not familiar with IMA code, maybe there is a reason which I'm unaware of...

Thanks,
Tao Liu



>
> --
> Regards,
> Pratyush Yadav
>


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv