[PW_SID:1123054] riscv: ftrace: reject out-of-range non-direct targets#2236
[PW_SID:1123054] riscv: ftrace: reject out-of-range non-direct targets#2236linux-riscv-bot wants to merge 3 commits into
Conversation
A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(),
where image->segment[i].buf might be NULL and copied unchecked.
The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by
kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without
a check in machine_kexec_prepare():
kexec_file_load
-> kimage_file_alloc_init()
-> kimage_file_prepare_segments()
-> ima_add_kexec_buffer()
-> kexec_add_buffer()
-> machine_kexec_prepare()
-> memcpy()
Address this by adding a check before the data copy attempt.
Fixes: b7fb4d7 ("RISC-V: use memcpy for kexec_file mode")
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/kexec/CAO7dBbVftLUhd2qrh7hmijTB3PEPfZAhykCGqEfrPoOcSrrj-w@mail.gmail.com/
Acked-by: Baoquan He <bhe@redhat.com>
Acked-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Signed-off-by: Tao Liu <ltao@redhat.com>
Link: https://patch.msgid.link/20260705232706.30265-2-ltao@redhat.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
RISC-V initializes the AUIPC half of each ftrace callsite to reach ftrace_caller and later only patches the JALR instruction. The old ftrace_make_call() code redirected any requested target outside the JALR immediate range back to FTRACE_ADDR. That fallback is only valid for direct-call targets, where ftrace_caller can still dispatch through op->direct_call. For an ops-specific trampoline, the generic ftrace core requested a call to ops->trampoline. Redirecting the site to FTRACE_ADDR instead enters ftrace_caller and invokes op->func, bypassing that trampoline. ftrace_modify_call() had the same issue more directly: it ignored old_addr and addr and always validated and updated the site as FTRACE_ADDR. Add a helper to resolve call targets consistently. Keep targets that fit in the existing AUIPC/JALR window, redirect only out-of-range direct-call targets through FTRACE_ADDR, and reject other out-of-range targets. Use the resolved old and new targets in ftrace_modify_call() so the architecture implementation follows the generic contract. Signed-off-by: Rui Qi <qirui.001@bytedance.com> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
|
Patch 1: "riscv: ftrace: reject out-of-range non-direct targets" |
869345e to
f54dc6c
Compare
3 participants
PR for series 1123054 applied to workflow__riscv__fixes
Name: riscv: ftrace: reject out-of-range non-direct targets
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1123054
Version: 1