The function deserialize_bitmap() calculates the reservation size using: int sz = 1 << (order + PAGE_SHIFT); If a corrupted KHO image provides an order >= 20 (on systems with 4KB pages), the shift amount becomes >= 32, which overflows the 32-bit integer. This results in a zero-size memory reservation. Furthermore, the physical address calculation: phys_addr_t phys = elm->phys_start + (bit << (order + PAGE_SHIFT)); can also overflow and wrap around if the order is large. This allows a corrupt KHO image to cause out-of-bounds updates to page->private of arbitrary physical pages during early boot. Fix this by adding a bounds check for the order field. Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Marco Elver --- kernel/liveupdate/kexec_handover.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c index b851b09a8e99..ec353e4b68a6 100644 --- a/kernel/liveupdate/kexec_handover.c +++ b/kernel/liveupdate/kexec_handover.c @@ -463,6 +463,11 @@ static void __init deserialize_bitmap(unsigned int order, struct kho_mem_phys_bits *bitmap = KHOSER_LOAD_PTR(elm->bitmap); unsigned long bit; + if (order > MAX_PAGE_ORDER) { + pr_warn("invalid order %u for preserved bitmap\n", order); + return; + } + for_each_set_bit(bit, bitmap->preserve, PRESERVE_BITS) { int sz = 1 << (order + PAGE_SHIFT); phys_addr_t phys = -- 2.53.0.335.g19a08e0c02-goog