[PATCH] kexec: return -ENOEXEC from image probe functions on mismatch

[PATCH] kexec: return -ENOEXEC from image probe functions on mismatch

[Mukesh Pilaniya]

Several kexec_file_load() image probe functions return -EINVAL when
they do not recognize the image format.  A probe function that rejects
an image should return -ENOEXEC to indicate that the image is not a
recognized executable format.  -EINVAL implies a problem with the
syscall parameters, not with image recognition.

kexec_image_probe_default() iterates through registered loaders and
returns the last probe's error code to the caller.  That error
propagates as the kexec_file_load() return value to userspace.
Returning -EINVAL from a probe when no loader matches is semantically
incorrect and misleads userspace about the nature of the failure.

Return -ENOEXEC from all probe functions and their helpers when the
image format is not recognized.

Signed-off-by: Mukesh Pilaniya <mpilaniy@redhat.com>
---
branch: next-20260812
base commit: 28d012efb4327f9c75d5e042a7c91e9a542efa98
---
 arch/arm64/kernel/kexec_image.c   | 4 ++--
 arch/loongarch/kernel/kexec_efi.c | 4 ++--
 arch/riscv/kernel/kexec_image.c   | 4 ++--
 kernel/kexec_elf.c                | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
index b70f4df15a1a..101259874d44 100644
--- a/arch/arm64/kernel/kexec_image.c
+++ b/arch/arm64/kernel/kexec_image.c
@@ -25,10 +25,10 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
 		(const struct arm64_image_header *)(kernel_buf);
 
 	if (!h || (kernel_len < sizeof(*h)))
-		return -EINVAL;
+		return -ENOEXEC;
 
 	if (memcmp(&h->magic, ARM64_IMAGE_MAGIC, sizeof(h->magic)))
-		return -EINVAL;
+		return -ENOEXEC;
 
 	return 0;
 }
diff --git a/arch/loongarch/kernel/kexec_efi.c b/arch/loongarch/kernel/kexec_efi.c
index 5ee78ebb1546..28a1d0420ba3 100644
--- a/arch/loongarch/kernel/kexec_efi.c
+++ b/arch/loongarch/kernel/kexec_efi.c
@@ -24,12 +24,12 @@ static int efi_kexec_probe(const char *kernel_buf, unsigned long kernel_len)
 
 	if (!h || (kernel_len < sizeof(*h))) {
 		kexec_dprintk("No LoongArch image header.\n");
-		return -EINVAL;
+		return -ENOEXEC;
 	}
 
 	if (!loongarch_header_check_dos_sig(h)) {
 		kexec_dprintk("No LoongArch PE image header.\n");
-		return -EINVAL;
+		return -ENOEXEC;
 	}
 
 	return 0;
diff --git a/arch/riscv/kernel/kexec_image.c b/arch/riscv/kernel/kexec_image.c
index 51dc89259f16..963a25f5b55b 100644
--- a/arch/riscv/kernel/kexec_image.c
+++ b/arch/riscv/kernel/kexec_image.c
@@ -20,7 +20,7 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
 	const struct riscv_image_header *h = (const struct riscv_image_header *)kernel_buf;
 
 	if (!h || kernel_len < sizeof(*h))
-		return -EINVAL;
+		return -ENOEXEC;
 
 	/* According to Documentation/arch/riscv/boot-image-header.rst,
 	 * use "magic2" field to check when version >= 0.2.
@@ -28,7 +28,7 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
 
 	if (h->version >= RISCV_HEADER_VERSION &&
 	    memcmp(&h->magic2, RISCV_IMAGE_MAGIC2, sizeof(h->magic2)))
-		return -EINVAL;
+		return -ENOEXEC;
 
 	return 0;
 }
diff --git a/kernel/kexec_elf.c b/kernel/kexec_elf.c
index 3a5c25b2adc9..89a444a00693 100644
--- a/kernel/kexec_elf.c
+++ b/kernel/kexec_elf.c
@@ -172,7 +172,7 @@ static int elf_read_ehdr(const char *buf, size_t len, struct elfhdr *ehdr)
 
 	default:
 		pr_debug("Unknown ELF class.\n");
-		return -EINVAL;
+		return -ENOEXEC;
 	}
 
 	return elf_is_ehdr_sane(ehdr, len) ? 0 : -ENOEXEC;
@@ -236,7 +236,7 @@ static int elf_read_phdr(const char *buf, size_t len,
 
 	default:
 		pr_debug("Unknown ELF class.\n");
-		return -EINVAL;
+		return -ENOEXEC;
 	}
 
 	return elf_is_phdr_sane(phdr, len) ? 0 : -ENOEXEC;

---
base-commit: 28d012efb4327f9c75d5e042a7c91e9a542efa98
change-id: 20260813-mpilaniy-ffb0cc92c313

Best regards,
--  
Mukesh Pilaniya <mpilaniy@redhat.com>


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] kexec: return -ENOEXEC from image probe functions on mismatch

[Philipp Rudo]

Hi Mukesh,

the patch looks good to me.

There is also a corresponding kexec-tools patch, which was accidentally
opened as a Github PR (https://github.com/horms/kexec-tools/pull/12).
It will be sent to kexec@lists.infradead.org shortly.

Thanks

Reviewed-by: Philipp Rudo <prudo@redhat.com>

On Thu, 13 Aug 2026 12:36:29 +0530
Mukesh Pilaniya <mpilaniy@redhat.com> wrote:

> Several kexec_file_load() image probe functions return -EINVAL when
> they do not recognize the image format.  A probe function that rejects
> an image should return -ENOEXEC to indicate that the image is not a
> recognized executable format.  -EINVAL implies a problem with the
> syscall parameters, not with image recognition.
> 
> kexec_image_probe_default() iterates through registered loaders and
> returns the last probe's error code to the caller.  That error
> propagates as the kexec_file_load() return value to userspace.
> Returning -EINVAL from a probe when no loader matches is semantically
> incorrect and misleads userspace about the nature of the failure.
> 
> Return -ENOEXEC from all probe functions and their helpers when the
> image format is not recognized.
> 
> Signed-off-by: Mukesh Pilaniya <mpilaniy@redhat.com>
> ---
> branch: next-20260812
> base commit: 28d012efb4327f9c75d5e042a7c91e9a542efa98
> ---
>  arch/arm64/kernel/kexec_image.c   | 4 ++--
>  arch/loongarch/kernel/kexec_efi.c | 4 ++--
>  arch/riscv/kernel/kexec_image.c   | 4 ++--
>  kernel/kexec_elf.c                | 4 ++--
>  4 files changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
> index b70f4df15a1a..101259874d44 100644
> --- a/arch/arm64/kernel/kexec_image.c
> +++ b/arch/arm64/kernel/kexec_image.c
> @@ -25,10 +25,10 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
>  		(const struct arm64_image_header *)(kernel_buf);
>  
>  	if (!h || (kernel_len < sizeof(*h)))
> -		return -EINVAL;
> +		return -ENOEXEC;
>  
>  	if (memcmp(&h->magic, ARM64_IMAGE_MAGIC, sizeof(h->magic)))
> -		return -EINVAL;
> +		return -ENOEXEC;
>  
>  	return 0;
>  }
> diff --git a/arch/loongarch/kernel/kexec_efi.c b/arch/loongarch/kernel/kexec_efi.c
> index 5ee78ebb1546..28a1d0420ba3 100644
> --- a/arch/loongarch/kernel/kexec_efi.c
> +++ b/arch/loongarch/kernel/kexec_efi.c
> @@ -24,12 +24,12 @@ static int efi_kexec_probe(const char *kernel_buf, unsigned long kernel_len)
>  
>  	if (!h || (kernel_len < sizeof(*h))) {
>  		kexec_dprintk("No LoongArch image header.\n");
> -		return -EINVAL;
> +		return -ENOEXEC;
>  	}
>  
>  	if (!loongarch_header_check_dos_sig(h)) {
>  		kexec_dprintk("No LoongArch PE image header.\n");
> -		return -EINVAL;
> +		return -ENOEXEC;
>  	}
>  
>  	return 0;
> diff --git a/arch/riscv/kernel/kexec_image.c b/arch/riscv/kernel/kexec_image.c
> index 51dc89259f16..963a25f5b55b 100644
> --- a/arch/riscv/kernel/kexec_image.c
> +++ b/arch/riscv/kernel/kexec_image.c
> @@ -20,7 +20,7 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
>  	const struct riscv_image_header *h = (const struct riscv_image_header *)kernel_buf;
>  
>  	if (!h || kernel_len < sizeof(*h))
> -		return -EINVAL;
> +		return -ENOEXEC;
>  
>  	/* According to Documentation/arch/riscv/boot-image-header.rst,
>  	 * use "magic2" field to check when version >= 0.2.
> @@ -28,7 +28,7 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
>  
>  	if (h->version >= RISCV_HEADER_VERSION &&
>  	    memcmp(&h->magic2, RISCV_IMAGE_MAGIC2, sizeof(h->magic2)))
> -		return -EINVAL;
> +		return -ENOEXEC;
>  
>  	return 0;
>  }
> diff --git a/kernel/kexec_elf.c b/kernel/kexec_elf.c
> index 3a5c25b2adc9..89a444a00693 100644
> --- a/kernel/kexec_elf.c
> +++ b/kernel/kexec_elf.c
> @@ -172,7 +172,7 @@ static int elf_read_ehdr(const char *buf, size_t len, struct elfhdr *ehdr)
>  
>  	default:
>  		pr_debug("Unknown ELF class.\n");
> -		return -EINVAL;
> +		return -ENOEXEC;
>  	}
>  
>  	return elf_is_ehdr_sane(ehdr, len) ? 0 : -ENOEXEC;
> @@ -236,7 +236,7 @@ static int elf_read_phdr(const char *buf, size_t len,
>  
>  	default:
>  		pr_debug("Unknown ELF class.\n");
> -		return -EINVAL;
> +		return -ENOEXEC;
>  	}
>  
>  	return elf_is_phdr_sane(phdr, len) ? 0 : -ENOEXEC;
> 
> ---
> base-commit: 28d012efb4327f9c75d5e042a7c91e9a542efa98
> change-id: 20260813-mpilaniy-ffb0cc92c313
> 
> Best regards,
> --  
> Mukesh Pilaniya <mpilaniy@redhat.com>
> 


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] kexec: return -ENOEXEC from image probe functions on mismatch

[Mukesh Pilaniya]

Hi Philipp,

On 13/08/26 6:43 pm, Philipp Rudo wrote:
> Hi Mukesh,
> 
> the patch looks good to me.
> 
> There is also a corresponding kexec-tools patch, which was accidentally
> opened as a Github PR (https://github.com/horms/kexec-tools/pull/12).
> It will be sent to kexec@lists.infradead.org shortly.
> 
> Thanks
> 
> Reviewed-by: Philipp Rudo <prudo@redhat.com>
> 
The kexec-tools patch has now been posted to the mailing list.
It can be found here:
https://lore.kernel.org/all/20260814075329.30203-1-mpilaniy@redhat.com/

> On Thu, 13 Aug 2026 12:36:29 +0530
> Mukesh Pilaniya <mpilaniy@redhat.com> wrote:
> 
>> Several kexec_file_load() image probe functions return -EINVAL when
>> they do not recognize the image format.  A probe function that rejects
>> an image should return -ENOEXEC to indicate that the image is not a
>> recognized executable format.  -EINVAL implies a problem with the
>> syscall parameters, not with image recognition.
>>
>> kexec_image_probe_default() iterates through registered loaders and
>> returns the last probe's error code to the caller.  That error
>> propagates as the kexec_file_load() return value to userspace.
>> Returning -EINVAL from a probe when no loader matches is semantically
>> incorrect and misleads userspace about the nature of the failure.
>>
>> Return -ENOEXEC from all probe functions and their helpers when the
>> image format is not recognized.
>>
>> Signed-off-by: Mukesh Pilaniya <mpilaniy@redhat.com>
>> ---
>> branch: next-20260812
>> base commit: 28d012efb4327f9c75d5e042a7c91e9a542efa98
>> ---
>>   arch/arm64/kernel/kexec_image.c   | 4 ++--
>>   arch/loongarch/kernel/kexec_efi.c | 4 ++--
>>   arch/riscv/kernel/kexec_image.c   | 4 ++--
>>   kernel/kexec_elf.c                | 4 ++--
>>   4 files changed, 8 insertions(+), 8 deletions(-)
>>
>> diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
>> index b70f4df15a1a..101259874d44 100644
>> --- a/arch/arm64/kernel/kexec_image.c
>> +++ b/arch/arm64/kernel/kexec_image.c
>> @@ -25,10 +25,10 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
>>   		(const struct arm64_image_header *)(kernel_buf);
>>   
>>   	if (!h || (kernel_len < sizeof(*h)))
>> -		return -EINVAL;
>> +		return -ENOEXEC;
>>   
>>   	if (memcmp(&h->magic, ARM64_IMAGE_MAGIC, sizeof(h->magic)))
>> -		return -EINVAL;
>> +		return -ENOEXEC;
>>   
>>   	return 0;
>>   }
>> diff --git a/arch/loongarch/kernel/kexec_efi.c b/arch/loongarch/kernel/kexec_efi.c
>> index 5ee78ebb1546..28a1d0420ba3 100644
>> --- a/arch/loongarch/kernel/kexec_efi.c
>> +++ b/arch/loongarch/kernel/kexec_efi.c
>> @@ -24,12 +24,12 @@ static int efi_kexec_probe(const char *kernel_buf, unsigned long kernel_len)
>>   
>>   	if (!h || (kernel_len < sizeof(*h))) {
>>   		kexec_dprintk("No LoongArch image header.\n");
>> -		return -EINVAL;
>> +		return -ENOEXEC;
>>   	}
>>   
>>   	if (!loongarch_header_check_dos_sig(h)) {
>>   		kexec_dprintk("No LoongArch PE image header.\n");
>> -		return -EINVAL;
>> +		return -ENOEXEC;
>>   	}
>>   
>>   	return 0;
>> diff --git a/arch/riscv/kernel/kexec_image.c b/arch/riscv/kernel/kexec_image.c
>> index 51dc89259f16..963a25f5b55b 100644
>> --- a/arch/riscv/kernel/kexec_image.c
>> +++ b/arch/riscv/kernel/kexec_image.c
>> @@ -20,7 +20,7 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
>>   	const struct riscv_image_header *h = (const struct riscv_image_header *)kernel_buf;
>>   
>>   	if (!h || kernel_len < sizeof(*h))
>> -		return -EINVAL;
>> +		return -ENOEXEC;
>>   
>>   	/* According to Documentation/arch/riscv/boot-image-header.rst,
>>   	 * use "magic2" field to check when version >= 0.2.
>> @@ -28,7 +28,7 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
>>   
>>   	if (h->version >= RISCV_HEADER_VERSION &&
>>   	    memcmp(&h->magic2, RISCV_IMAGE_MAGIC2, sizeof(h->magic2)))
>> -		return -EINVAL;
>> +		return -ENOEXEC;
>>   
>>   	return 0;
>>   }
>> diff --git a/kernel/kexec_elf.c b/kernel/kexec_elf.c
>> index 3a5c25b2adc9..89a444a00693 100644
>> --- a/kernel/kexec_elf.c
>> +++ b/kernel/kexec_elf.c
>> @@ -172,7 +172,7 @@ static int elf_read_ehdr(const char *buf, size_t len, struct elfhdr *ehdr)
>>   
>>   	default:
>>   		pr_debug("Unknown ELF class.\n");
>> -		return -EINVAL;
>> +		return -ENOEXEC;
>>   	}
>>   
>>   	return elf_is_ehdr_sane(ehdr, len) ? 0 : -ENOEXEC;
>> @@ -236,7 +236,7 @@ static int elf_read_phdr(const char *buf, size_t len,
>>   
>>   	default:
>>   		pr_debug("Unknown ELF class.\n");
>> -		return -EINVAL;
>> +		return -ENOEXEC;
>>   	}
>>   
>>   	return elf_is_phdr_sane(phdr, len) ? 0 : -ENOEXEC;
>>
>> ---
>> base-commit: 28d012efb4327f9c75d5e042a7c91e9a542efa98
>> change-id: 20260813-mpilaniy-ffb0cc92c313
>>
>> Best regards,
>> --
>> Mukesh Pilaniya <mpilaniy@redhat.com>
>>
> 


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] kexec: return -ENOEXEC from image probe functions on mismatch

[Pratyush Yadav]

On Thu, Aug 13 2026, Mukesh Pilaniya wrote:

> Several kexec_file_load() image probe functions return -EINVAL when
> they do not recognize the image format.  A probe function that rejects
> an image should return -ENOEXEC to indicate that the image is not a
> recognized executable format.  -EINVAL implies a problem with the
> syscall parameters, not with image recognition.
>
> kexec_image_probe_default() iterates through registered loaders and
> returns the last probe's error code to the caller.  That error
> propagates as the kexec_file_load() return value to userspace.
> Returning -EINVAL from a probe when no loader matches is semantically
> incorrect and misleads userspace about the nature of the failure.
>
> Return -ENOEXEC from all probe functions and their helpers when the
> image format is not recognized.

Sounds fine in principle but can you please also share what the real
problem you face is and how changing these return codes helps? These
error codes are uAPI and while we _can_ change them as long as we don't
break something, there should be a clear motivation for doing so.

[...]

-- 
Regards,
Pratyush Yadav

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] kexec: return -ENOEXEC from image probe functions on mismatch

[Mukesh Pilaniya]

Hi Pratyush,
On 14/08/26 7:43 pm, Pratyush Yadav wrote:
> On Thu, Aug 13 2026, Mukesh Pilaniya wrote:
> 
>> Several kexec_file_load() image probe functions return -EINVAL when
>> they do not recognize the image format.  A probe function that rejects
>> an image should return -ENOEXEC to indicate that the image is not a
>> recognized executable format.  -EINVAL implies a problem with the
>> syscall parameters, not with image recognition.
>>
>> kexec_image_probe_default() iterates through registered loaders and
>> returns the last probe's error code to the caller.  That error
>> propagates as the kexec_file_load() return value to userspace.
>> Returning -EINVAL from a probe when no loader matches is semantically
>> incorrect and misleads userspace about the nature of the failure.
>>
>> Return -ENOEXEC from all probe functions and their helpers when the
>> image format is not recognized.
> 
> Sounds fine in principle but can you please also share what the real
> problem you face is and how changing these return codes helps? These
> error codes are uAPI and while we _can_ change them as long as we don't
> break something, there should be a clear motivation for doing so.
> 
> [...]
> 
While debugging a misleading error on s390x where kexec -s reported
"syscall kexec_file_load not available" instead of the actual EINVAL
from a kernel command line that exceeded the architecture limit, we
traced the problem to the kexec-tools userspace utility treating
EINVAL the same as ENOSYS and ENOEXEC -- as a signal to silently fall
back to kexec_load().

kexec-tools supports two syscalls: kexec_file_load() and the older
kexec_load(). With -a (the default), it tries kexec_file_load()
first and falls back to kexec_load() when the syscall is not
implemented (ENOSYS) or the kernel does not have a loader for the
image format. With -s, it uses kexec_file_load() only with no
fallback.

When the kernel returns -EINVAL it means something went wrong while
loading the image, not that the syscall is missing or the image
format is unrecognized. kexec-tools should not fall back to the
older syscall in that case. However, some kernel probe functions
currently return -EINVAL when the image header does not match,
instead of returning -ENOEXEC. Keeping EINVAL in the fallback set
to accommodate these probes has the side effect of also hiding
genuine loading errors like an oversized command line.

kexec-tools should only fall back when kexec_file_load() is not
implemented or does not have a matching loader -- not when something
goes wrong during load.

The fix on the kexec-tools side is to remove EINVAL from the fallback
set, but that requires the kernel to be clean first -- probe functions
must return -ENOEXEC when they do not recognize an image format, not -EINVAL.

kexec-tools patch:
https://lore.kernel.org/all/20260814075329.30203-1-mpilaniy@redhat.com/

A review of all kexec_file_ops.probe implementations found that arm64
image_probe(), riscv image_probe(), and loongarch efi_kexec_probe()
return -EINVAL where they should return -ENOEXEC. x86 bzImage64_probe()
and s390 s390_elf_probe() already use -ENOEXEC correctly.


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv