LinuxPPC-Dev Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Jinjie Ruan <ruanjinjie@huawei.com>
To: <maddy@linux.ibm.com>, <mpe@ellerman.id.au>, <npiggin@gmail.com>,
	<chleroy@kernel.org>, <sourabhjain@linux.ibm.com>,
	<rppt@kernel.org>, <baoquan.he@linux.dev>,
	<hbathini@linux.ibm.com>, <adityag@linux.ibm.com>,
	<ritesh.list@gmail.com>, <bauerman@linux.ibm.com>,
	<linuxppc-dev@lists.ozlabs.org>, <linux-kernel@vger.kernel.org>
Cc: <ruanjinjie@huawei.com>
Subject: [PATCH v2 2/3] powerpc/kexec_file: Fix null-ptr-def in extra size calculation
Date: Wed, 29 Jul 2026 09:29:47 +0800	[thread overview]
Message-ID: <20260729012948.2797865-3-ruanjinjie@huawei.com> (raw)
In-Reply-To: <20260729012948.2797865-1-ruanjinjie@huawei.com>

A static Sashiko AI review identified a potential NULL pointer
dereference in kexec_extra_fdt_size_ppc64().

On platforms without any reserved memory regions,
get_reserved_memory_ranges() can return 0 while leaving 'rmem'
unallocated as NULL. Passing it directly leads to a kernel panic when
evaluating 'rmem->nr_ranges'.

Add a NULL check for 'rmem' to prevent this crash.

Cc: Sourabh Jain <sourabhjain@linux.ibm.com>
Cc: Hari Bathini <hbathini@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: stable@vger.kernel.org
Fixes: 0d3ff067331e ("powerpc/kexec_file: fix extra size calculation for kexec FDT")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
 arch/powerpc/kexec/file_load_64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/kexec/file_load_64.c b/arch/powerpc/kexec/file_load_64.c
index 8c72e12ea44e..6075b1c88511 100644
--- a/arch/powerpc/kexec/file_load_64.c
+++ b/arch/powerpc/kexec/file_load_64.c
@@ -664,7 +664,7 @@ unsigned int kexec_extra_fdt_size_ppc64(struct kimage *image, struct crash_mem *
 		extra_size += (cpu_nodes - boot_cpu_node_count) * cpu_node_size();
 
 	/* Consider extra space for reserved memory ranges if any */
-	if (rmem->nr_ranges > 0)
+	if (rmem && rmem->nr_ranges > 0)
 		extra_size += sizeof(struct fdt_reserve_entry) * rmem->nr_ranges;
 
 	return extra_size + kdump_extra_fdt_size_ppc64(image, cpu_nodes);
-- 
2.34.1



  parent reply	other threads:[~2026-07-29  1:29 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-29  1:29 [PATCH v2 0/3] powerpc/kexec_file: Fix some bugs Jinjie Ruan
2026-07-29  1:29 ` [PATCH v2 1/3] powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() Jinjie Ruan
2026-07-29  1:29 ` Jinjie Ruan [this message]
2026-07-29  4:01   ` [PATCH v2 2/3] powerpc/kexec_file: Fix null-ptr-def in extra size calculation Sourabh Jain
2026-07-29  1:29 ` [PATCH v2 3/3] powerpc/kexec_file: Prevent kexec range truncation Jinjie Ruan
2026-07-29  4:43   ` Sourabh Jain
2026-07-29  6:26     ` Jinjie Ruan
2026-07-29  6:44       ` Sourabh Jain
2026-07-29  7:06         ` Jinjie Ruan
2026-07-29  8:18           ` Sourabh Jain

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260729012948.2797865-3-ruanjinjie@huawei.com \
    --to=ruanjinjie@huawei.com \
    --cc=adityag@linux.ibm.com \
    --cc=baoquan.he@linux.dev \
    --cc=bauerman@linux.ibm.com \
    --cc=chleroy@kernel.org \
    --cc=hbathini@linux.ibm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linuxppc-dev@lists.ozlabs.org \
    --cc=maddy@linux.ibm.com \
    --cc=mpe@ellerman.id.au \
    --cc=npiggin@gmail.com \
    --cc=ritesh.list@gmail.com \
    --cc=rppt@kernel.org \
    --cc=sourabhjain@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox