From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-173.mta1.migadu.com (out-173.mta1.migadu.com [95.215.58.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6B5D30EF63 for ; Thu, 30 Jul 2026 13:03:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785416597; cv=none; b=lB8GBJLYybRa+cI+Jp1gXRnVqi/AKLaHw2b6Bjv/iJRLMySs485p/RzcUeNd+uREGODlu8GXLphHZ7BIZbtblk/jrkUkDSaN+ua6nlFT/NQoJwbtYNtcO6R/6Y58emjqb/4OdaKKDZW0Y4J20q5U6AUPMiHvzK0/uGm8Qe3QR8s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785416597; c=relaxed/simple; bh=MSpHvAE60fRFfd3RO2phyZRoGoJZJYyVPtinNvJ5nas=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Ozrm3vP3zTtkYOBKrY+Wu4/mqHHaYp8hucttqE61d4kPz3NbzSSDyhp8QBuYAQWFiX3+rr7tadrmN/WiLP/h9sOMcIQVnOPCKqBIyB6RzNlw9jx8qV4Xgtj3ePmJ1jSJGiGsisCHCOhv3gMyUiqD+xC2Qu6G2KLQ10Tp23Udfk8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=bzn++hGX; arc=none smtp.client-ip=95.215.58.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="bzn++hGX" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785416582; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=dw9urfr1YSTyHqzxKfth9ryU6HxR+cmSffIEWqq5hyI=; b=bzn++hGXQ6Hf/7+mdXm1csZNZrvuBtP75eBbJWIXxR9iAt5xYddO1hLFPUBB3zdN4AKv6u 7DRrwnABlwj8g1felD5sSo73/ttlD4hzoCkhiSTBTzzXjUN9M40XlezrpnT/KkQbuwhNK6 wlfVM59gNUgd+ZHvyv0b8ETn+nOslhc= From: Thorsten Blum To: Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , "Christophe Leroy (CS GROUP)" , Kees Cook , "Gustavo A. R. Silva" , Sourabh Jain , Aditya Gupta , Hari Bathini Cc: Thorsten Blum , linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH] powerpc/kexec: Annotate umem_info members with __counted_by_ptr Date: Thu, 30 Jul 2026 15:02:48 +0200 Message-ID: <20260730130248.597249-2-thorsten.blum@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2355; i=thorsten.blum@linux.dev; h=from:subject; bh=MSpHvAE60fRFfd3RO2phyZRoGoJZJYyVPtinNvJ5nas=; b=owGbwMvMwCUWt7pQ4caZUj3G02pJDFnZ3hXn1/Z4a07NCL/aa1K1Q0nlT9N0s5tnN3H4RYrpz rPos5zcUcrCIMbFICumyPJg1o8ZvqU1lZtMInbCzGFlAhnCwMUpABNJqGRk+CcbdP6K8c7wZcqf /dJD0q1nKqReqn8pU+pWaLeo+hC3HiPD3O7ugzU38p1f53VzeXz/LSFwLGWD3EcOv+thjk++Jvp yAwA= X-Developer-Key: i=thorsten.blum@linux.dev; a=openpgp; fpr=1D60735E8AEF3BE473B69D84733678FD8DFEEAD4 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT Add __counted_by_ptr() to umem_info::buf and umem_info::ranges to improve access bounds checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Set the count fields before assigning the corresponding pointers, return early on krealloc() failure, and use sizeof(*buf) when deriving max_entries from the allocation size. Signed-off-by: Thorsten Blum --- arch/powerpc/kexec/file_load_64.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/arch/powerpc/kexec/file_load_64.c b/arch/powerpc/kexec/file_load_64.c index 8c72e12ea44e..6424b668f0e9 100644 --- a/arch/powerpc/kexec/file_load_64.c +++ b/arch/powerpc/kexec/file_load_64.c @@ -34,14 +34,15 @@ #include struct umem_info { - __be64 *buf; /* data buffer for usable-memory property */ + /* data buffer for usable-memory property */ + __be64 *buf __counted_by_ptr(max_entries); u32 size; /* size allocated for the data buffer */ u32 max_entries; /* maximum no. of entries */ u32 idx; /* index of current entry */ /* usable memory ranges to look up */ unsigned int nr_ranges; - const struct range *ranges; + const struct range *ranges __counted_by_ptr(nr_ranges); }; const struct kexec_file_ops * const kexec_file_loaders[] = { @@ -83,11 +84,12 @@ static __be64 *check_realloc_usable_mem(struct umem_info *um_info, int cnt) new_size = um_info->size + MEM_RANGE_CHUNK_SZ; tbuf = krealloc(um_info->buf, new_size, GFP_KERNEL); - if (tbuf) { - um_info->buf = tbuf; - um_info->size = new_size; - um_info->max_entries = (um_info->size / sizeof(u64)); - } + if (!tbuf) + return NULL; + + um_info->size = new_size; + um_info->max_entries = um_info->size / sizeof(*um_info->buf); + um_info->buf = tbuf; return tbuf; } @@ -288,13 +290,13 @@ static int update_usable_mem_fdt(void *fdt, struct crash_mem *usable_mem) return -EINVAL; } - um_info.buf = NULL; um_info.size = 0; um_info.max_entries = 0; - um_info.idx = 0; + um_info.buf = NULL; + um_info.idx = 0; /* Memory ranges to look up */ - um_info.ranges = &(usable_mem->ranges[0]); um_info.nr_ranges = usable_mem->nr_ranges; + um_info.ranges = usable_mem->ranges; dn = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory"); if (dn) {