From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 55C7F326D77 for ; Thu, 4 Dec 2025 21:40:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=140.211.166.183 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764884416; cv=none; b=R9/jR72G8OZ1Gy4GYHaoc0gsvW/Io5I7Oq7Hh5isWe7sSK1SbBaKvy0OMoYcwlVgeNC3Da26+pVB7cEkGpf+CTpTM9tdBxUsuzEip9COSwXGhKZydoxFzbV2ikBVezkLWSHuIM4kE9olOe74P3rJY/D7Jd+3HRVWX5A9s5gwZ/w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764884416; c=relaxed/simple; bh=e5voJri73XG4dzk62Y15gSyCQSjAgKlFU74ghwTcIQY=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=nv8okhkMscQgu2rLpdCCeI83j9FsDEaQOiVxkqE9u6zukgL2fP/wKhrFa4Fjl1EtAeMcfgoT8fLvpcPUSyW0+ZKtaFyfGUyb7aq+0jTC2IdWSBefTeiDY+WC0+q46R5PQbAJh1ili/XVQH12lo4PoWEcBUFEZGCbLumCPeHl2dE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gentoo.org; spf=pass smtp.mailfrom=gentoo.org; arc=none smtp.client-ip=140.211.166.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gentoo.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gentoo.org Received: from 7.3.d.a.e.5.6.1.6.d.a.6.d.8.1.2.c.6.e.0.c.6.2.0.0.b.8.0.1.0.0.2.ip6.arpa (7.3.d.a.e.5.6.1.6.d.a.6.d.8.1.2.c.6.e.0.c.6.2.0.0.b.8.0.1.0.0.2.ip6.arpa [IPv6:2001:8b0:26c:e6c:218d:6ad6:165e:ad37]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange secp256r1 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: chewi) by smtp.gentoo.org (Postfix) with ESMTPSA id 65863341039; Thu, 04 Dec 2025 21:40:13 +0000 (UTC) Message-ID: <552cf43e8ce7c7e430cd18feb20efb1dee2350e0.camel@gentoo.org> Subject: Re: [PATCH] x86: fix oops caused by old EFI info on kexec boot From: James Le Cuirot To: Ard Biesheuvel , Ingo Molnar Cc: x86@kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Borislav Petkov , Dave Hansen , "H . Peter Anvin" Date: Thu, 04 Dec 2025 21:40:09 +0000 In-Reply-To: References: <20251126173209.374755-2-chewi@gentoo.org> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Thu, 2025-12-04 at 00:01 +0100, Ard Biesheuvel wrote: > On Wed, 3 Dec 2025 at 23:57, Ard Biesheuvel wrote: > >=20 > > On Wed, 3 Dec 2025 at 19:13, Ingo Molnar wrote: > > >=20 > > > * James Le Cuirot wrote: > > >=20 > > > > kexec on x86 passes initrd details via the boot_params. If no initr= d is > > > > supplied, then ramdisk_size is 0. When determining whether to reser= ve > > > > memory for the initrd on the subsequent boot, ramdisk_size being 0 > > > > causes the logic to fall back to phys_initrd_start and phys_initrd_= size > > > > set from the EFI tables in efi.c. This is stale information from th= e > > > > initial boot. The system continues to boot and has even been seen t= o > > > > function under heavy load for days, but allocating very large amoun= ts of > > > > memory reliably triggers an oops rather than the OOM killer. > > > >=20 > > > > BUG: kernel NULL pointer dereference, address: 0000000000000008 > > > > #PF: supervisor write access in kernel mode > > > > #PF: error_code(0x0002) - not-present page > > > > PGD 0 P4D 0 > > > > Oops: Oops: 0002 [#1] SMP NOPTI > > > >=20 > > > > This issue was introduced in f4dc7fffa9873db50ec25624572f8217a6225d= e8 > > > > when the EFI stub initrd loading was unified between architectures. > > > >=20 > > > > Avoid the issue by checking whether the bootloader is not kexec bef= ore > > > > falling back to the EFI table values. > > > >=20 > > > > I strongly suspect this also affects other architectures. A differe= nt > > > > fix would be required there, and I do have a fix in mind, but I was > > > > unable to reproduce the issue under QEMU's aarch64 virt machine. I = think > > > > this is at least partly because it relies on ACPI while kexec passe= s the > > > > initd details via the device tree. > > > >=20 > > > > Signed-off-by: James Le Cuirot > > > > --- > > > > arch/x86/kernel/setup.c | 6 ++++-- > > > > 1 file changed, 4 insertions(+), 2 deletions(-) > > > >=20 > > > > diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c > > > > index 1b2edd07a3e1..8aa65daf121f 100644 > > > > --- a/arch/x86/kernel/setup.c > > > > +++ b/arch/x86/kernel/setup.c > > > > @@ -300,7 +300,8 @@ static u64 __init get_ramdisk_image(void) > > > >=20 > > > > ramdisk_image |=3D (u64)boot_params.ext_ramdisk_image << 32; > > > >=20 > > > > - if (ramdisk_image =3D=3D 0) > > > > + /* Don't fall back for kexec as phys_initrd_start will be sta= le */ > > > > + if (ramdisk_image =3D=3D 0 && (boot_params.hdr.type_of_loader= >> 4) !=3D 0xD) > > > > ramdisk_image =3D phys_initrd_start; > > > >=20 > > > > return ramdisk_image; > > > > @@ -311,7 +312,8 @@ static u64 __init get_ramdisk_size(void) > > > >=20 > > > > ramdisk_size |=3D (u64)boot_params.ext_ramdisk_size << 32; > > > >=20 > > > > - if (ramdisk_size =3D=3D 0) > > > > + /* Don't fall back for kexec as phys_initrd_start will be sta= le */ > > > > + if (ramdisk_size =3D=3D 0 && (boot_params.hdr.type_of_loader = >> 4) !=3D 0xD) > > > > ramdisk_size =3D phys_initrd_size; > > >=20 > > > Yeah, so this looks like a good fix - but please let's > > > introduce some sort of enum for the bootloader IDs > > > in arch/x86/include/uapi/asm/bootparam.h, I had to search > > > way too long to figure out what 0xD is and where it > > > was defined :-) > > >=20 > > > Also, please introduce a "x86_bootloader_is_kexec()" kind > > > of helper inline function as well. > > >=20 > >=20 > > It might be better to fix this in the generic EFI code, and simply > > wipe the EFI config table that the EFI stub created to pass the initrd > > info. That way, it works for all architectures, and there is no need > > for special x86 hacks. >=20 > I.e., >=20 > --- a/drivers/firmware/efi/efi.c > +++ b/drivers/firmware/efi/efi.c > @@ -818,6 +818,7 @@ > if (tbl) { > phys_initrd_start =3D tbl->base; > phys_initrd_size =3D tbl->size; > + tbl->base =3D tbl->size =3D 0; > early_memunmap(tbl, sizeof(*tbl)); > } > } I can confirm that this fixes the problem. I had considered wiping the tabl= e, but I was trying to do it later, which seemed harder to do. I didn't consid= er wiping it immediately, but I now realise this data isn't needed afterwards.= I only tested amd64, but I trust it will work for other architectures. Please= go ahead with this.