From: Jinjie Ruan <ruanjinjie@huawei.com>
To: <maddy@linux.ibm.com>, <mpe@ellerman.id.au>, <npiggin@gmail.com>,
<chleroy@kernel.org>, <sourabhjain@linux.ibm.com>,
<rppt@kernel.org>, <baoquan.he@linux.dev>,
<hbathini@linux.ibm.com>, <adityag@linux.ibm.com>,
<ritesh.list@gmail.com>, <bauerman@linux.ibm.com>,
<linuxppc-dev@lists.ozlabs.org>, <linux-kernel@vger.kernel.org>
Cc: <ruanjinjie@huawei.com>
Subject: [PATCH v2 2/3] powerpc/kexec_file: Fix null-ptr-def in extra size calculation
Date: Wed, 29 Jul 2026 09:29:47 +0800 [thread overview]
Message-ID: <20260729012948.2797865-3-ruanjinjie@huawei.com> (raw)
In-Reply-To: <20260729012948.2797865-1-ruanjinjie@huawei.com>
A static Sashiko AI review identified a potential NULL pointer
dereference in kexec_extra_fdt_size_ppc64().
On platforms without any reserved memory regions,
get_reserved_memory_ranges() can return 0 while leaving 'rmem'
unallocated as NULL. Passing it directly leads to a kernel panic when
evaluating 'rmem->nr_ranges'.
Add a NULL check for 'rmem' to prevent this crash.
Cc: Sourabh Jain <sourabhjain@linux.ibm.com>
Cc: Hari Bathini <hbathini@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: stable@vger.kernel.org
Fixes: 0d3ff067331e ("powerpc/kexec_file: fix extra size calculation for kexec FDT")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
arch/powerpc/kexec/file_load_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kexec/file_load_64.c b/arch/powerpc/kexec/file_load_64.c
index 8c72e12ea44e..6075b1c88511 100644
--- a/arch/powerpc/kexec/file_load_64.c
+++ b/arch/powerpc/kexec/file_load_64.c
@@ -664,7 +664,7 @@ unsigned int kexec_extra_fdt_size_ppc64(struct kimage *image, struct crash_mem *
extra_size += (cpu_nodes - boot_cpu_node_count) * cpu_node_size();
/* Consider extra space for reserved memory ranges if any */
- if (rmem->nr_ranges > 0)
+ if (rmem && rmem->nr_ranges > 0)
extra_size += sizeof(struct fdt_reserve_entry) * rmem->nr_ranges;
return extra_size + kdump_extra_fdt_size_ppc64(image, cpu_nodes);
--
2.34.1
next prev parent reply other threads:[~2026-07-29 1:29 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-29 1:29 [PATCH v2 0/3] powerpc/kexec_file: Fix some bugs Jinjie Ruan
2026-07-29 1:29 ` [PATCH v2 1/3] powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() Jinjie Ruan
2026-07-29 1:29 ` Jinjie Ruan [this message]
2026-07-29 4:01 ` [PATCH v2 2/3] powerpc/kexec_file: Fix null-ptr-def in extra size calculation Sourabh Jain
2026-07-29 1:29 ` [PATCH v2 3/3] powerpc/kexec_file: Prevent kexec range truncation Jinjie Ruan
2026-07-29 4:43 ` Sourabh Jain
2026-07-29 6:26 ` Jinjie Ruan
2026-07-29 6:44 ` Sourabh Jain
2026-07-29 7:06 ` Jinjie Ruan
2026-07-29 8:18 ` Sourabh Jain
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260729012948.2797865-3-ruanjinjie@huawei.com \
--to=ruanjinjie@huawei.com \
--cc=adityag@linux.ibm.com \
--cc=baoquan.he@linux.dev \
--cc=bauerman@linux.ibm.com \
--cc=chleroy@kernel.org \
--cc=hbathini@linux.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=maddy@linux.ibm.com \
--cc=mpe@ellerman.id.au \
--cc=npiggin@gmail.com \
--cc=ritesh.list@gmail.com \
--cc=rppt@kernel.org \
--cc=sourabhjain@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox