[PATCH v7 03/15] arm64: kexec_file: Fix CMA page leaks in segment placement retry loops

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] arm64: kexec_file: image_load() skips RAM below CMA on non-CMA retry
--

commit a177040c2457cfc0cd78f4ced8850ba0e9322a44
Author: Jinjie Ruan <ruanjinjie at huawei.com>

arm64: kexec_file: Fix CMA page leaks in segment placement retry loops

This commit frees CMA-backed segments when rewinding image->nr_segments in
image_load() and load_other_segments(), and sets image->no_cma when a
CMA-allocated kernel segment placement retry occurs.

> diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
> index 74d24c8aa2fad..6ed1991e31429 100644
> --- a/arch/arm64/kernel/kexec_image.c
> +++ b/arch/arm64/kernel/kexec_image.c
> @@ -111,6 +111,14 @@ static void *image_load(struct kimage *image,
>  		 * We couldn't find space for the other segments; erase the
>  		 * kernel segment and try the next available hole.
>  		 */
> +		/*
> +		 * kexec_alloc_contig() ignores buf_min, so disable CMA to
> +		 * let the retry make progress.
> +		 */
> +		if (image->segment_cma[kernel_segment_number])
> +			image->no_cma = true;
> +
> +		kexec_free_segment_cma(image, kernel_segment_number);
>  		image->nr_segments -= 1;
>  		kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz;
>  		kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;

[Severity: Medium]
When falling back from a CMA allocation to a non-CMA search in image_load(),
does unconditionally advancing kbuf.buf_min to kernel_segment->mem +
kernel_segment->memsz skip all free RAM below the CMA region?

In image_load(), kbuf.buf_min starts at 0 with kbuf.top_down set to false:

arch/arm64/kernel/kexec_image.c:image_load() {
	kbuf.image = image;
	kbuf.buf_min = 0;
	kbuf.buf_max = ULONG_MAX;
	kbuf.top_down = false;
	...
	while ((ret = kexec_add_buffer(&kbuf)) == 0) {

On the first iteration, kexec_add_buffer() -> kexec_locate_mem_hole() calls
kexec_alloc_contig() before walking memblock:

kernel/kexec_file.c:kexec_locate_mem_hole() {
	if (!kexec_alloc_contig(kbuf))
		return 0;

	if (!IS_ENABLED(CONFIG_ARCH_KEEP_MEMBLOCK))
		ret = kexec_walk_resources(kbuf, locate_mem_hole_callback);
	else
		ret = kexec_walk_memblock(kbuf, locate_mem_hole_callback);

Because kexec_alloc_contig() allocates from the CMA area without consulting
kbuf.buf_min, the bottom-up walk starting from 0 has not run yet.

If load_other_segments() then fails to place initrd or dtb above
kernel_segment->mem + kernel_segment->memsz (for example, when CMA is near
the top of RAM and lacks space for the remaining segments), setting
image->no_cma = true and advancing kbuf.buf_min to kernel_segment->mem +
kernel_segment->memsz causes the next iteration's kexec_walk_memblock() to
search only above the CMA region, where load_other_segments() already failed
to find space.

Should kbuf.buf_min only be updated to kernel_segment->mem +
kernel_segment->memsz when the failed kernel segment was not allocated from
CMA?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026075201.699550-1-ruanjinjie@huawei.com?part=3