[PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

[Tao Liu]

Kindly ping, any comments?

Thanks,
Tao Liu

On Fri, May 29, 2026 at 3:35 PM Tao Liu <ltao at redhat.com> wrote:
>
> A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
> where image->segment[i].buf might be NULL and copied unchecked.
>
> The NULL buf comes from security/integrity/ima/ima_kexec.c:
> ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(),
> but kbuf.buffer is NULL.
>
> Fix this by simply adding a check before copy.
>
> Signed-off-by: Tao Liu <ltao at redhat.com>
> ---
>  arch/riscv/kernel/machine_kexec.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
> index 2306ce3e5f22..d81d576f9cb5 100644
> --- a/arch/riscv/kernel/machine_kexec.c
> +++ b/arch/riscv/kernel/machine_kexec.c
> @@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
>                 if (image->segment[i].memsz <= sizeof(fdt))
>                         continue;
>
> +               if (image->segment[i].buf == NULL)
> +                       continue;
> +
>                 if (image->file_mode)
>                         memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
>                 else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
> --
> 2.47.0
>