[PATCH] x86/kexec: Push kjump return address even for non-kjump kexec

From: David Woodhouse

Date: Thu Apr 02 2026 - 06:34:58 EST


From: David Woodhouse <dwmw@xxxxxxxxxxxx>

The version of purgatory code shipped by kexec-tools attempts to look
above the top of its stack to find a return address for a kjump, even
in a non-kjump kexec. Since commit 2cacf7f23a02 ("x86/kexec: Fix stack
and handling of re-entry point for ::preserve_context") the page above
the stack might not be there, leading to a fault (which is at least
now caught my by exception-handling code in kexec).

That commit fixed things for the actual kjump path, but no longer
"gratuitously" pushes the unused return address to the stack in the
non-kjump path. Put that *back* in the non-kjump path, to prevent
purgatory from crashing when trying to access it.

Reported-by: Rohan Kakulawaram <rohanka@xxxxxxxxxx>
Tested-by: Rohan Kakulawaram <rohanka@xxxxxxxxxx>
Fixes: 2cacf7f23a02 ("x86/kexec: Fix stack and handling of re-entry point for ::preserve_context")
Signed-off-by: David Woodhouse <dwmw@xxxxxxxxxxxx>
---
arch/x86/kernel/relocate_kernel_64.S | 2 ++
1 file changed, 2 insertions(+)

diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
index 4ffba68dc57b..301c586282aa 100644
--- a/arch/x86/kernel/relocate_kernel_64.S
+++ b/arch/x86/kernel/relocate_kernel_64.S
@@ -136,6 +136,8 @@ SYM_CODE_START_LOCAL_NOALIGN(identity_mapped)
* %r13 original CR4 when relocate_kernel() was invoked
*/

+ /* set return address to 0 if not preserving context */
+ pushq $0
/* store the start address on the stack */
pushq %rdx

--
2.43.0


Attachment: smime.p7s
Description: S/MIME cryptographic signature