Re: [PATCH v2 1/2] kexec: return -ENOEXEC from image probe functions on mismatch

[Bradley Morgan]

On 19 August 2026 18:47:22 BST, Mukesh Pilaniya <mpilaniy at redhat.com>
wrote:
>Several kexec_file_load() image probe functions return -EINVAL when
>they do not recognize the image format.  A probe function that rejects
>an image should return -ENOEXEC to indicate that the image is not a
>recognized executable format.  -EINVAL implies a problem with the
>syscall parameters, not with image recognition.
>
>kexec_image_probe_default() iterates through registered loaders and
>returns the last probe's error code to the caller.  That error
>propagates as the kexec_file_load() return value to userspace.
>Returning -EINVAL from a probe when no loader matches is semantically
>incorrect and misleads userspace about the nature of the failure.
>
>Return -ENOEXEC from all probe functions and their helpers when the
>image format is not recognized.
>
>Signed-off-by: Mukesh Pilaniya <mpilaniy at redhat.com>
>Reviewed-by: Philipp Rudo <prudo at redhat.com>
>Reviewed-by: Pratyush Yadav <pratyush at kernel.org>
Reviewed-by: Bradley Morgan <include at grrlz.net>

>---
> arch/arm64/kernel/kexec_image.c   | 4 ++--
> arch/loongarch/kernel/kexec_efi.c | 4 ++--
> arch/riscv/kernel/kexec_image.c   | 4 ++--
> kernel/kexec_elf.c                | 4 ++--
> 4 files changed, 8 insertions(+), 8 deletions(-)
>
>diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
>index b70f4df15a1a..101259874d44 100644
>--- a/arch/arm64/kernel/kexec_image.c
>+++ b/arch/arm64/kernel/kexec_image.c
>@@ -25,10 +25,10 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
> 		(const struct arm64_image_header *)(kernel_buf);
> 
> 	if (!h || (kernel_len < sizeof(*h)))
>-		return -EINVAL;
>+		return -ENOEXEC;
> 
> 	if (memcmp(&h->magic, ARM64_IMAGE_MAGIC, sizeof(h->magic)))
>-		return -EINVAL;
>+		return -ENOEXEC;
> 
> 	return 0;
> }
>diff --git a/arch/loongarch/kernel/kexec_efi.c b/arch/loongarch/kernel/kexec_efi.c
>index 5ee78ebb1546..28a1d0420ba3 100644
>--- a/arch/loongarch/kernel/kexec_efi.c
>+++ b/arch/loongarch/kernel/kexec_efi.c
>@@ -24,12 +24,12 @@ static int efi_kexec_probe(const char *kernel_buf, unsigned long kernel_len)
> 
> 	if (!h || (kernel_len < sizeof(*h))) {
> 		kexec_dprintk("No LoongArch image header.\n");
>-		return -EINVAL;
>+		return -ENOEXEC;
> 	}
> 
> 	if (!loongarch_header_check_dos_sig(h)) {
> 		kexec_dprintk("No LoongArch PE image header.\n");
>-		return -EINVAL;
>+		return -ENOEXEC;
> 	}
> 
> 	return 0;
>diff --git a/arch/riscv/kernel/kexec_image.c b/arch/riscv/kernel/kexec_image.c
>index 51dc89259f16..963a25f5b55b 100644
>--- a/arch/riscv/kernel/kexec_image.c
>+++ b/arch/riscv/kernel/kexec_image.c
>@@ -20,7 +20,7 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
> 	const struct riscv_image_header *h = (const struct riscv_image_header *)kernel_buf;
> 
> 	if (!h || kernel_len < sizeof(*h))
>-		return -EINVAL;
>+		return -ENOEXEC;
> 
> 	/* According to Documentation/arch/riscv/boot-image-header.rst,
> 	 * use "magic2" field to check when version >= 0.2.
>@@ -28,7 +28,7 @@ static int image_probe(const char *kernel_buf, unsigned long kernel_len)
> 
> 	if (h->version >= RISCV_HEADER_VERSION &&
> 	    memcmp(&h->magic2, RISCV_IMAGE_MAGIC2, sizeof(h->magic2)))
>-		return -EINVAL;
>+		return -ENOEXEC;
> 
> 	return 0;
> }
>diff --git a/kernel/kexec_elf.c b/kernel/kexec_elf.c
>index 3a5c25b2adc9..89a444a00693 100644
>--- a/kernel/kexec_elf.c
>+++ b/kernel/kexec_elf.c
>@@ -172,7 +172,7 @@ static int elf_read_ehdr(const char *buf, size_t len, struct elfhdr *ehdr)
> 
> 	default:
> 		pr_debug("Unknown ELF class.\n");
>-		return -EINVAL;
>+		return -ENOEXEC;
> 	}
> 
> 	return elf_is_ehdr_sane(ehdr, len) ? 0 : -ENOEXEC;
>@@ -236,7 +236,7 @@ static int elf_read_phdr(const char *buf, size_t len,
> 
> 	default:
> 		pr_debug("Unknown ELF class.\n");
>-		return -EINVAL;
>+		return -ENOEXEC;
> 	}
> 
> 	return elf_is_phdr_sane(phdr, len) ? 0 : -ENOEXEC;
>
>

Thanks!