commit 11fac7a004113466b7155e9b0d836156cf8a7e8d
author Linus Torvalds <torvalds@linux-foundation.org> Sun Apr 25 09:02:13 2021 -0700
committer Linus Torvalds <torvalds@linux-foundation.org> Sun Apr 25 09:02:13 2021 -0700
tree a4f6f4f52e64d903c05a161594e7d29049200251
parent 2a1d7946fa53cea2083e5981ff55a8176ab2be6b
parent 5849cdf8c120e3979c57d34be55b92d90a77a47e

Merge tag 'x86_urgent_for_v5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fix from Borislav Petkov:
 "Fix an out-of-bounds memory access when setting up a crash kernel with
  kexec"

* tag 'x86_urgent_for_v5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access

arch/x86/kernel/crash.c

diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index a8f3af2..b1deacb 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -337,7 +337,7 @@
 	struct crash_memmap_data cmd;
 	struct crash_mem *cmem;
 
-	cmem = vzalloc(sizeof(struct crash_mem));
+	cmem = vzalloc(struct_size(cmem, ranges, 1));
 	if (!cmem)
 		return -ENOMEM;