Commit 0b07092d authored by Pratyush Yadav's avatar Pratyush Yadav Committed by Andrew Morton
Browse files

kho: fix out-of-bounds access of vmalloc chunk 

The list of pages in a vmalloc chunk is NULL-terminated.  So when looping
through the pages in a vmalloc chunk, both kho_restore_vmalloc() and
kho_vmalloc_unpreserve_chunk() rightly make sure to stop when encountering
a NULL page.  But when the chunk is full, the loops do not stop and go
past the bounds of chunk->phys, resulting in out-of-bounds memory access,
and possibly the restoration or unpreservation of an invalid page.

Fix this by making sure the processing of chunk stops at the end of the
array.

Link: https://lkml.kernel.org/r/20251103110159.8399-1-pratyush@kernel.org


Fixes: a667300b ("kho: add support for preserving vmalloc allocations")
Signed-off-by: default avatarPratyush Yadav <pratyush@kernel.org>
Reviewed-by: default avatarMike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Alexander Graf <graf@amazon.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent bba717bb

kernel/kexec_handover.c

+2 −2
Original line number Diff line number Diff line
@@ -889,7 +889,7 @@ static void kho_vmalloc_unpreserve_chunk(struct kho_vmalloc_chunk *chunk) 


	__kho_unpreserve(track, pfn, pfn + 1);



	for (int i = 0; chunk->phys[i]; i++) {

	for (int i = 0; i < ARRAY_SIZE(chunk->phys) && chunk->phys[i]; i++) {

		pfn = PHYS_PFN(chunk->phys[i]);

		__kho_unpreserve(track, pfn, pfn + 1);

	}
@@ -1012,7 +1012,7 @@ void *kho_restore_vmalloc(const struct kho_vmalloc *preservation) 
	while (chunk) {

		struct page *page;



		for (int i = 0; chunk->phys[i]; i++) {

		for (int i = 0; i < ARRAY_SIZE(chunk->phys) && chunk->phys[i]; i++) {

			phys_addr_t phys = chunk->phys[i];



			if (idx + contig_pages > total_pages)