From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8DB09C982DE for ; Mon, 21 Sep 2026 09:05:22 +0000 (UTC) Received: from boromir.ozlabs.org (localhost [127.0.0.1]) by lists.ozlabs.org (Postfix) with ESMTP id 4hpHNQ73J7z2yft; Mon, 21 Sep 2026 19:04:22 +1000 (AEST) Authentication-Results: lists.ozlabs.org; arc=none smtp.remote-ip=113.46.200.221 ARC-Seal: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1789981462; cv=none; b=iTpuK2cfaCMjSWc+fNzoS2sBQIDgh7SYuht1eg3fudaxjjN8raJWxJCruIZxt3wuqupZjdT6WkxmhyzZ42KSiaQqw0XhknlNThsL6GzK6kS6PdLYthgP7Vq2ZyOcU/OhqI40zhpL4nJ1WR5DNHqTupnEDMmwGS9YanUO6v/ejF41cxJpF9VzkXSKX+fabtlQL53PIVFjeLiFzjBEieXHUmuq/eMpoI5icwghBoFRDMcSOxMg8kE4lTiJc35KiRKBeGfNvWFZAyhpwXTss3aGHbOAqwe6bZGPdyDrCX6HHD5GgbFmRpWmHukI5kZV1ngXg48y6OqAXnLZxEjvmW3Deg== ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1789981462; c=relaxed/relaxed; bh=gl9dOVAVG56ScS9MwUOL4momh5UtqrFy6pN1ShFcuZM=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=kZby/CzyDEvbPuY9X2gxs8PlQ4vHgDWwVIj3B/hylT+wSdPhFj9g/VpHbOyoA6FlYmON+xjRVo4z9YRPEUWSdVzSU/+AwMPds0F1/7SdLrCxRMu1svO7NpcNfmaG02c7pIzdY0RvOVdXdiKGfBogxim3C5PnyoP+PibRfDS9G8dsk3ANOjBGvkozQSjsv818BndrGWlcX4ILdJQ+gQZ+J0Fa0LR7AOnEVyHIhEMUTqHqKiqYR+YoVaXrbES1n+WMOB5DqnzgDQb+ZS29YKjy1fCVAuIQbGDG0aBlWpxrX8tKhLn8+3XusEmphryxRzHCrhqkRw0oAtgUBUGZtfaiXQ== ARC-Authentication-Results: i=1; lists.ozlabs.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; dkim=pass (1024-bit key; unprotected) header.d=huawei.com header.i=@huawei.com header.a=rsa-sha256 header.s=dkim header.b=wVs/Hs9G; dkim-atps=neutral; spf=pass (client-ip=113.46.200.221; helo=canpmsgout06.his.huawei.com; envelope-from=ruanjinjie@huawei.com; receiver=lists.ozlabs.org) smtp.mailfrom=huawei.com Authentication-Results: lists.ozlabs.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=huawei.com header.i=@huawei.com header.a=rsa-sha256 header.s=dkim header.b=wVs/Hs9G; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=huawei.com (client-ip=113.46.200.221; helo=canpmsgout06.his.huawei.com; envelope-from=ruanjinjie@huawei.com; receiver=lists.ozlabs.org) Received: from canpmsgout06.his.huawei.com (canpmsgout06.his.huawei.com [113.46.200.221]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4hpHNP6m7wz3bjW for ; Mon, 21 Sep 2026 19:04:21 +1000 (AEST) dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=gl9dOVAVG56ScS9MwUOL4momh5UtqrFy6pN1ShFcuZM=; b=wVs/Hs9Gq6VG/cWAMpWvzJmy/oIAMsdmFRrHLaMN8dhT/208NNm+Jy57C8JdLMxP37J0PUlpB GvTnqbaNF3Y1buLGfFQc0tAbMgmC9XUKdLppSMLKPgLCRodGAQm9QZNfIEVZADGVfpSUfrMTgAo 355Yjh2Bx4bZrE0WgEv0YQ0= Received: from mail.maildlp.com (unknown [172.19.162.140]) by canpmsgout06.his.huawei.com (SkyGuard) with ESMTPS id 4hpH6N5yyJzRhjW; Mon, 21 Sep 2026 16:52:12 +0800 (CST) Received: from kwepemk200008.china.huawei.com (unknown [7.202.194.74]) by mail.maildlp.com (Postfix) with ESMTPS id 7F7142011D; Mon, 21 Sep 2026 17:04:13 +0800 (CST) Received: from huawei.com (10.90.53.73) by kwepemk200008.china.huawei.com (7.202.194.74) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 21 Sep 2026 17:04:11 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , CC: Subject: [PATCH v6 09/14] x86/crash: Fix massive out-of-bounds write on 32-bit Highmem Date: Mon, 21 Sep 2026 17:04:45 +0800 Message-ID: <20260921090450.807575-10-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260921090450.807575-1-ruanjinjie@huawei.com> References: <20260921090450.807575-1-ruanjinjie@huawei.com> X-Mailing-List: linuxppc-dev@lists.ozlabs.org List-Id: List-Help: List-Owner: List-Post: List-Archive: , List-Subscribe: , , List-Unsubscribe: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.90.53.73] X-ClientProxiedBy: kwepems500002.china.huawei.com (7.221.188.17) To kwepemk200008.china.huawei.com (7.202.194.74) On 32-bit x86 systems with HIGHMEM, kmap_local_page() only maps a single 4KB page. However, the elfcorehdr segment can span several pages (up to hundreds of kilobytes). The original code blindly copies 'elfsz' bytes at once via memcpy_flushcache(), overwriting adjacent fixmap entries or critical virtual addresses. Fix this by copying the new elfcorehdr page by page. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: "Mike Rapoport (Microsoft)" Cc: Vishal Verma Cc: Baoquan He Cc: Chao Gao Cc: Sean Christopherson Cc: Eric DeVolder Cc: Hari Bathini Cc: Andrew Morton Cc: Sourabh Jain Cc: stable@vger.kernel.org Fixes: ea53ad9cf73b ("x86/crash: add x86 crash hotplug support") Link: https://sashiko.dev/#/patchset/20260907125404.922123-1-ruanjinjie%40huawei.com Signed-off-by: Jinjie Ruan --- arch/x86/kernel/crash.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c index e681ec9cf1dc..3c9f4fbbe7ff 100644 --- a/arch/x86/kernel/crash.c +++ b/arch/x86/kernel/crash.c @@ -447,9 +447,10 @@ unsigned int arch_crash_get_elfcorehdr_size(void) */ void arch_crash_handle_hotplug_event(struct kimage *image, void *arg) { - void *elfbuf = NULL, *old_elfcorehdr; unsigned long mem, memsz; unsigned long elfsz = 0; + void *elfbuf = NULL; + unsigned long done; /* * As crash_prepare_elf64_headers() has already described all @@ -484,21 +485,20 @@ void arch_crash_handle_hotplug_event(struct kimage *image, void *arg) /* * Copy new elfcorehdr over the old elfcorehdr at destination. - */ - old_elfcorehdr = kmap_local_page(pfn_to_page(mem >> PAGE_SHIFT)); - if (!old_elfcorehdr) { - pr_err("mapping elfcorehdr segment failed\n"); - goto out; - } - - /* - * Temporarily invalidate the crash image while the - * elfcorehdr is updated. + * The segment is physically contiguous but can span several pages. + * On 32-bit Highmem architectures, kmap_local_page() maps only a + * single page at a time, so copy page by page. */ xchg(&kexec_crash_image, NULL); - memcpy_flushcache(old_elfcorehdr, elfbuf, elfsz); + for (done = 0; done < elfsz; ) { + size_t chunk = min_t(size_t, PAGE_SIZE, elfsz - done); + void *dst = kmap_local_page(pfn_to_page((mem + done) >> PAGE_SHIFT)); + + memcpy_flushcache(dst, elfbuf + done, chunk); + kunmap_local(dst); + done += chunk; + } xchg(&kexec_crash_image, image); - kunmap_local(old_elfcorehdr); pr_debug("updated elfcorehdr\n"); out: -- 2.34.1