Skip to content

Commit b7fb4d7

Browse files
Liao Changpalmer-dabbelt
authored andcommitted
RISC-V: use memcpy for kexec_file mode
The pointer to buffer loading kernel binaries is in kernel space for kexec_fil mode, When copy_from_user copies data from pointer to a block of memory, it checkes that the pointer is in the user space range, on RISCV-V that is: static inline bool __access_ok(unsigned long addr, unsigned long size) { return size <= TASK_SIZE && addr <= TASK_SIZE - size; } and TASK_SIZE is 0x4000000000 for 64-bits, which now causes copy_from_user to reject the access of the field 'buf' of struct kexec_segment that is in range [CONFIG_PAGE_OFFSET - VMALLOC_SIZE, CONFIG_PAGE_OFFSET), is invalid user space pointer. This patch fixes this issue by skipping access_ok(), use mempcy() instead. Signed-off-by: Liao Chang <liaochang1@huawei.com> Link: https://lore.kernel.org/r/20220408100914.150110-3-lizhengyu3@huawei.com Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
1 parent 4853f68 commit b7fb4d7

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

arch/riscv/kernel/machine_kexec.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,9 @@ machine_kexec_prepare(struct kimage *image)
6565
if (image->segment[i].memsz <= sizeof(fdt))
6666
continue;
6767

68-
if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
68+
if (image->file_mode)
69+
memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
70+
else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
6971
continue;
7072

7173
if (fdt_check_header(&fdt))

0 commit comments

Comments
 (0)