[PW_SID:1122773] [v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap#2232
Closed
linux-riscv-bot wants to merge 3 commits into
Closed
[PW_SID:1122773] [v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap#2232linux-riscv-bot wants to merge 3 commits into
linux-riscv-bot wants to merge 3 commits into
Conversation
A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(),
where image->segment[i].buf might be NULL and copied unchecked.
The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by
kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without
a check in machine_kexec_prepare():
kexec_file_load
-> kimage_file_alloc_init()
-> kimage_file_prepare_segments()
-> ima_add_kexec_buffer()
-> kexec_add_buffer()
-> machine_kexec_prepare()
-> memcpy()
Address this by adding a check before the data copy attempt.
Fixes: b7fb4d7 ("RISC-V: use memcpy for kexec_file mode")
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/kexec/CAO7dBbVftLUhd2qrh7hmijTB3PEPfZAhykCGqEfrPoOcSrrj-w@mail.gmail.com/
Acked-by: Baoquan He <bhe@redhat.com>
Acked-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Signed-off-by: Tao Liu <ltao@redhat.com>
Link: https://patch.msgid.link/20260705232706.30265-2-ltao@redhat.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
section_activate() does not flush TLB after populating new vmemmap pages. On most architectures, this is okay. However it is a problem on RISC-V since there the TLB caching non-present entries is permitted, which causes spurious faults on some hardwares. This seems to be most easily reproduced with DEBUG_VM=y and PAGE_POISONING=y, which causes these newly mapped struct pages to be poisoned i.e. written to immediately after mapping. Extend the RISC-V flush_cache_vmap() to also handle the vmemmap range, and call it after hotplugging vmemmap, which gets the possible spurious fault handled in the exception handler. At least for now, the only other architecture with both SPARSEMEM_VMEMMAP and flush_cache_vmap() is PowerPC, which has a similar problem with newly valid PTEs. But there flush_cache_vmap() is just a ptesync. So it should be safe to do this for generic code while having minimal performance impact. Suggested-by: Muchun Song <muchun.song@linux.dev> Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
Author
|
Patch 1: "[v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap" |
linux-riscv-bot
force-pushed
the
workflow__riscv__fixes
branch
4 times, most recently
from
July 11, 2026 01:54
2b6a725 to
da477a6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR for series 1122773 applied to workflow__riscv__fixes
Name: [v5] mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1122773
Version: 5