[PATCH v7 05/15] LoongArch: kexec_file: Fix CMA page leaks in segment placement retry loops

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] LoongArch: kexec_file: efi_kexec_load() skips RAM below CMA on retry
--

commit f502069414c135fd39705a4caf6f9bdd9bb1a976
Author: Jinjie Ruan <ruanjinjie at huawei.com>

LoongArch: kexec_file: Fix CMA page leaks in segment placement retry loops

This commit fixes CMA page leaks in efi_kexec_load() and
load_other_segments() when segment placement fails, and disables CMA on
retry so kexec_add_buffer() does not repeatedly allocate the same CMA
region.

Link: https://sashiko.dev/#/patchset/20260729031235.2840255-1-ruanjinjie%40huawei.com

> diff --git a/arch/loongarch/kernel/kexec_efi.c b/arch/loongarch/kernel/kexec_efi.c
> index 5ee78ebb1546e..d42711b895a2c 100644
> --- a/arch/loongarch/kernel/kexec_efi.c
> +++ b/arch/loongarch/kernel/kexec_efi.c
> @@ -86,6 +86,14 @@ static void *efi_kexec_load(struct kimage *image,
>  		 * We couldn't find space for the other segments; erase the
>  		 * kernel segment and try the next available hole.
>  		 */
> +		/*
> +		 * kexec_alloc_contig() ignores buf_min, so disable CMA to
> +		 * let the retry make progress.
> +		 */
> +		if (image->segment_cma[kernel_segment_number])
> +			image->no_cma = true;
> +
> +		kexec_free_segment_cma(image, kernel_segment_number);
>  		image->nr_segments -= 1;
>  		kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz;
>  		kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;

[Severity: Medium]
When falling back from a CMA allocation to a normal bottom-up System RAM
search in efi_kexec_load(), does advancing kbuf.buf_min skip valid System
RAM located below the CMA region?

Before the retry loop in efi_kexec_load(), kbuf is set up for a bottom-up
search starting at text_offset:

    kbuf.top_down = false;
    ...
    kbuf.buf_min = text_offset;

On the first iteration, kexec_add_buffer() -> kexec_locate_mem_hole() ->
kexec_alloc_contig() allocates the kernel segment from CMA, which ignores
kbuf.buf_min and may place the kernel high in physical memory (for example,
near the top of DRAM or above 4GB).

If load_other_segments() then fails to place the initrd because there is
not enough space above the CMA kernel segment, the retry path sets
image->no_cma = true so the next iteration falls back to
kexec_walk_memblock(). However, it still updates kbuf.buf_min:

    kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz;

Because the first attempt came from CMA rather than a bottom-up walk from
text_offset, won't advancing kbuf.buf_min past the CMA allocation skip all
System RAM in [text_offset, kernel_segment->mem + kernel_segment->memsz)
and cause kexec_file_load() to fail with -EADDRNOTAVAIL?

Should kbuf.buf_min only be advanced when the failed kernel segment was not
allocated from CMA?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026075201.699550-1-ruanjinjie@huawei.com?part=5