Re: [PATCH 1/2] s390/ipl: Fix NULL deref in kdump without re-IPL parm block
Heiko Carstens <[email protected]>
| Newsgroups | org.kernel.vger.linux-s390 |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Aug 13, 2026 at 01:06:54PM +0200, Vasily Gorbik wrote:
> Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might
> not provide an IPL parameter block. In this case, reipl_type_init()
> selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.
>
> kdump passes the re-IPL parameter block to the dump kernel through
> os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl
> block checksum calculation"), the os_info entry was added only for
> IPL types which initialized reipl_block_actual. That commit moved the
> os_info update to machine_crash_shutdown(), making it unconditional. As
> a result, set_os_info_reipl_block() dereferences reipl_block_actual for
> IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero
> contains readable lowcore data and the resulting empty os_info entry is
> ignored by the dump kernel.
>
> Skip the os_info update when no re-IPL parameter block is available.
> Kdump then collect the dump and reboot without setting re-IPL parameter
> block.
>
> Fixes: 3b9678472bab ("s390/ipl: correct kdump reipl block checksum calculation")
> Signed-off-by: Vasily Gorbik <[email protected]>
> ---
> arch/s390/kernel/ipl.c | 2 ++
> 1 file changed, 2 insertions(+)
Reviewed-by: Heiko Carstens <[email protected]>