linux-kernel - Re: [PATCH] arm64: kexec: Initialize kexec_buf struct in image

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aK3HVqt6I5KxoHia@J2N7QTR9R3>
Date: Tue, 26 Aug 2025 15:40:22 +0100
From: Mark Rutland <mark.rutland@....com>
To: Breno Leitao <leitao@...ian.org>
Cc: Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will@...nel.org>, kexec@...ts.infradead.org,
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
	bhe@...hat.com, oxu@...hat.com, berrange@...hat.com,
	kernel-team@...a.com, Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] arm64: kexec: Initialize kexec_buf struct in image_load()

On Tue, Aug 26, 2025 at 05:08:51AM -0700, Breno Leitao wrote:
> The kexec_buf structure was previously declared without initialization
> in image_load(). This led to a UBSAN warning when the structure was
> expanded and uninitialized fields were accessed [1].

Just to check my understanding, is that only a problem for new fields
(e.g. the 'random' field added in [1]), or do we have UBSAN warnigns for
any existing fields? I assume there's no problem with existing fields
today.

> Zero-initializing kexec_buf at declaration ensures all fields are
> cleanly set, preventing future instances of uninitialized memory being
> used.
> 
> Andrew Morton suggested that this function is only called 3x a week[2],
> thus, the memset() cost is inexpressive.
> 
> Link: https://lore.kernel.org/all/oninomspajhxp4omtdapxnckxydbk2nzmrix7rggmpukpnzadw@c67o7njgdgm3/ [1]
> Link: https://lore.kernel.org/all/20250825180531.94bfb86a26a43127c0a1296f@linux-foundation.org/ [2]
> Suggested-by: Andrew Morton <akpm@...ux-foundation.org>
> Signed-off-by: Breno Leitao <leitao@...ian.org>

This looks fine to me, but I reckon it should be added to the series
which extends kexec_buf, unless there's some reason to avoid that?

> ---
>  arch/arm64/kernel/kexec_image.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

IIUC arch/arm64/kernel/machine_kexec_file.c would need the same
treatment in load_other_segments().

If other architectures need this, it'd probably make sense to clean that
up treewide in one go. It looks like at least riscv and s390 need that
from a quick grep:

| [mark@...rids:~/src/linux]% git grep -w 'struct kexec_buf .*;'
| arch/arm64/kernel/kexec_image.c:        struct kexec_buf kbuf;
| arch/arm64/kernel/machine_kexec_file.c: struct kexec_buf kbuf;
| arch/powerpc/include/asm/kexec.h:int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
| arch/powerpc/include/asm/kexec.h:                                 struct kexec_buf *kbuf);
| arch/riscv/kernel/elf_kexec.c:  struct kexec_buf kbuf;
| arch/riscv/kernel/elf_kexec.c:  struct kexec_buf kbuf;
| arch/riscv/kernel/elf_kexec.c:  struct kexec_buf kbuf;
| arch/s390/kernel/kexec_elf.c:   struct kexec_buf buf;
| arch/s390/kernel/kexec_image.c: struct kexec_buf buf;
| arch/s390/kernel/machine_kexec_file.c:  struct kexec_buf buf;
| arch/s390/kernel/machine_kexec_file.c:  struct kexec_buf buf;
| arch/s390/kernel/machine_kexec_file.c:  struct kexec_buf buf;
| include/linux/kexec.h:int kexec_load_purgatory(struct kimage *image, struct kexec_buf *kbuf);
| include/linux/kexec.h:extern int kexec_add_buffer(struct kexec_buf *kbuf);
| include/linux/kexec.h:int kexec_locate_mem_hole(struct kexec_buf *kbuf);
| kernel/kexec_file.c:    struct kexec_buf *kbuf = (struct kexec_buf *)arg;

Mark.

> 
> diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
> index 532d72ea42ee8..b70f4df15a1ae 100644
> --- a/arch/arm64/kernel/kexec_image.c
> +++ b/arch/arm64/kernel/kexec_image.c
> @@ -41,7 +41,7 @@ static void *image_load(struct kimage *image,
>  	struct arm64_image_header *h;
>  	u64 flags, value;
>  	bool be_image, be_kernel;
> -	struct kexec_buf kbuf;
> +	struct kexec_buf kbuf = {};
>  	unsigned long text_offset, kernel_segment_number;
>  	struct kexec_segment *kernel_segment;
>  	int ret;
> 
> ---
> base-commit: 7a77c6b5ce68a71b9102760a988a4564ff6d4106
> change-id: 20250826-akpm-18a57e3a39fd
> 
> Best regards,
> --  
> Breno Leitao <leitao@...ian.org>
> 
>