From nobody Fri Jul 24 05:23:04 2026 Received: from canpmsgout04.his.huawei.com (canpmsgout04.his.huawei.com [113.46.200.219]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 60909413784 for ; Thu, 23 Jul 2026 13:12:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.219 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812365; cv=none; b=QStGUdTuBRsrYItm/FcO6Jfj8OCh9a4RtQcK/Vign710MCeLcD6awkTFFhwssdPqokz/04wTecojv+fpRVv5KmUUGXhZrzEhP1pPcS4fb08ZPoYek+MxPccNL4+et8+2KSmO1nWu+basChVnt+VoyIEEBUU4MGMlZL8GuWPtAY0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812365; c=relaxed/simple; bh=DaWoUMA0vWtBSGGWLRD13HzfdP3cxxpQJxy8WH/RJqE=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=MBGJomEsZy4yTk17DX4cqql5aETQA9P3H8nY5yJjrvQtOxYLa2sgoLDBjD1zo6CjeFlzAtny4MFOGkjAuyDTvsHcSSKVvPNKxSvnmbo1/WDtjTFtdLUeaYLYsmWvuQh3jHs/Vf8EoMJ1AWakVubwG87mppES942q7eIs46daY5A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=urWVc2P0; arc=none smtp.client-ip=113.46.200.219 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="urWVc2P0" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=j4KV6sQuWKd8eS0AoGbKfckVEhtCT+5lyhSl3SyfXiA=; b=urWVc2P0ENx4blIXgZ5M+OtVOKt+sYZN9XXmSTw7XVqALzzXo3TdRX3PE3VyxIOZg4VByloEe b5mediW2Oh8/2F/+uq6eOWGBNEW5vePZYXQabopjTR9MCFdRxcV0zfyBmUqk4FKqGTQWuwkCBw2 vOlOwKMDaDkSBYHJGl9FVOM= Received: from mail.maildlp.com (unknown [172.19.162.144]) by canpmsgout04.his.huawei.com (SkyGuard) with ESMTPS id 4h5WWh261Gz1prKd; Thu, 23 Jul 2026 21:03:12 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id B9D8640538; Thu, 23 Jul 2026 21:12:37 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 23 Jul 2026 21:12:35 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH 1/8] powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() Date: Thu, 23 Jul 2026 21:12:35 +0800 Message-ID: <20260723131242.1537633-2-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723131242.1537633-1-ruanjinjie@huawei.com> References: <20260723131242.1537633-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" In get_crash_memory_ranges(), if crash_exclude_mem_range() failed after realloc_mem_ranges() has successfully allocated the cmem memory, it just returns an error but leaves cmem pointing to the allocated memory, nor is it freed in the caller update_crash_elfcorehdr(), which cause a memory leak, goto out to free the cmem. Cc: Sourabh Jain Cc: Hari Bathini Cc: Michael Ellerman Fixes: 849599b702ef ("powerpc/crash: add crash memory hotplug support") Reviewed-by: Sourabh Jain Signed-off-by: Jinjie Ruan --- arch/powerpc/kexec/crash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/kexec/crash.c b/arch/powerpc/kexec/crash.c index 60a917a6beaa..775895f31037 100644 --- a/arch/powerpc/kexec/crash.c +++ b/arch/powerpc/kexec/crash.c @@ -502,7 +502,7 @@ static void update_crash_elfcorehdr(struct kimage *imag= e, struct memory_notify * ret =3D get_crash_memory_ranges(&cmem); if (ret) { pr_err("Failed to get crash mem range\n"); - return; + goto out; } =20 /* --=20 2.34.1 From nobody Fri Jul 24 05:23:04 2026 Received: from canpmsgout02.his.huawei.com (canpmsgout02.his.huawei.com [113.46.200.217]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A45C413781 for ; Thu, 23 Jul 2026 13:12:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.217 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812367; cv=none; b=bZtYU2F4ZT8T4VikyzjRJIODsEyCuX3ZybEM68265vPP9+GVQ5aEmrSiuwFsoIU6VVijdqRK2a+Q6ypL9Po+QA9s+t4ZWVIkC0I+Mp1BbmmkNS5dWaVVhqvdj7/x6X8u0nUiv5DoppMx4HhWEmb0B+epNc91F0wXRcdAdHAqEuU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812367; c=relaxed/simple; bh=wdFNBQFTHB1UWvZ+6VIU9NXWG2HY38tIoz98HM3iVSg=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Oq70cvvJ4C+XEN+25BipIqaNMxzsCm2w15KkDnPl8AIPOMUcamYUrZCu78db4rdjbL38JRXzSnxx9MRuQS6M3GZBo3kWnbLjORvJ1ywJsIJEDu+zz4EgsjnJsXDtSXCsX2aMr3gxwQ+Vr9D77TYQdklnAb4DvcSserP96JDTJD8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=zezNzsem; arc=none smtp.client-ip=113.46.200.217 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="zezNzsem" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=m/t6g6wgy8f4j81AeTyq8Xtlv7t4otXq+WwFPCZjeiE=; b=zezNzsembULU7OU1aBZKtmlXYMfqiyhuVd/0EUpFld6FoKfxvHy2SHqOb479kLgfg3L85Cdx8 mFcP9trpiR6AmY+SzOas+7DcEuqhunASSnlRjjHpU37cVuiHPs/aDYZIE2xooHwPbR2Wc2GwkHB XJSpwQlYQPqIbe7aKweQzg0= Received: from mail.maildlp.com (unknown [172.19.162.197]) by canpmsgout02.his.huawei.com (SkyGuard) with ESMTPS id 4h5WWc5Fbbzcb2y; Thu, 23 Jul 2026 21:03:08 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 970464057D; Thu, 23 Jul 2026 21:12:39 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 23 Jul 2026 21:12:37 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH 2/8] powerpc/kexec_file: Fix null-ptr-def in extra size calculation Date: Thu, 23 Jul 2026 21:12:36 +0800 Message-ID: <20260723131242.1537633-3-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723131242.1537633-1-ruanjinjie@huawei.com> References: <20260723131242.1537633-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" A static Sashiko AI review identified a potential NULL pointer dereference in kexec_extra_fdt_size_ppc64(). On platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving 'rmem' unallocated as NULL. Passing it directly leads to a kernel panic when evaluating 'rmem->nr_ranges'. Add a NULL check for 'rmem' to prevent this crash. Cc: Sourabh Jain Cc: Hari Bathini Cc: Michael Ellerman Cc: stable@vger.kernel.org Fixes: 0d3ff067331e ("powerpc/kexec_file: fix extra size calculation for ke= xec FDT") Signed-off-by: Jinjie Ruan --- arch/powerpc/kexec/file_load_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/kexec/file_load_64.c b/arch/powerpc/kexec/file_lo= ad_64.c index 8c72e12ea44e..6075b1c88511 100644 --- a/arch/powerpc/kexec/file_load_64.c +++ b/arch/powerpc/kexec/file_load_64.c @@ -664,7 +664,7 @@ unsigned int kexec_extra_fdt_size_ppc64(struct kimage *= image, struct crash_mem * extra_size +=3D (cpu_nodes - boot_cpu_node_count) * cpu_node_size(); =20 /* Consider extra space for reserved memory ranges if any */ - if (rmem->nr_ranges > 0) + if (rmem && rmem->nr_ranges > 0) extra_size +=3D sizeof(struct fdt_reserve_entry) * rmem->nr_ranges; =20 return extra_size + kdump_extra_fdt_size_ppc64(image, cpu_nodes); --=20 2.34.1 From nobody Fri Jul 24 05:23:04 2026 Received: from canpmsgout06.his.huawei.com (canpmsgout06.his.huawei.com [113.46.200.221]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F8C1413787 for ; Thu, 23 Jul 2026 13:12:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.221 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812372; cv=none; b=tsrDtNqNGxfdOnsNwpfwQjzxW0JZh3Siy77wQ4/TGRk4eLYcgxNi49Bomfd5oYUIjzLGJVOwfdWjleaLnSuTgvzSllOdBRs0OfIffj407RyPGCQLLPhrSJJbLoeSaasTd8H6TWPs1wGb3zfguI/dPTipQAqYvGO8xUs0XShGd6k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812372; c=relaxed/simple; bh=UG+bpHnqlOFVnOv1MoOo9Mcr7qx5iQs/MxkI6PXb4XE=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=fafcOKEUVRCcBR5onUsK7id+5U1FBq4hyKWdqa7CzznEvdgRcyWmDi5b9d7ZF2nHl3qoM0Ur8AC1vuTmqFTmivlEi4PP+XFGAtgBboKSzwPBvtgeJtnQJwwvDuVWnR5FKpO1D1aCrLtnl3KF2vmc09lZj/jVkS0HDLduQJ9m2+0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=ktXP12RJ; arc=none smtp.client-ip=113.46.200.221 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="ktXP12RJ" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=BxzLiWI4cdI/ksC9wsJhk90k2fWRCD0GRES3OUH/72g=; b=ktXP12RJZscAAV64qHCLX9bFBZTEthSmNzZJA32uDAc8Jl1wLU/UCJKG9ppMSBN8YTgKj42MP ctEVPL1wW/rBxnvWU0S9zFc66jOO/Vjv2w2HwpjycCNWS3mNp4ID7gv4FR1cg5jdOBz4ebeRJ8t as4UYiMhA2km2qDToX7J+8g= Received: from mail.maildlp.com (unknown [172.19.162.144]) by canpmsgout06.his.huawei.com (SkyGuard) with ESMTPS id 4h5WWq1zYMzRhVH; Thu, 23 Jul 2026 21:03:19 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 742B040538; Thu, 23 Jul 2026 21:12:41 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 23 Jul 2026 21:12:39 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH 3/8] powerpc/kexec_file: Prevent kexec range truncation Date: Thu, 23 Jul 2026 21:12:37 +0800 Message-ID: <20260723131242.1537633-4-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723131242.1537633-1-ruanjinjie@huawei.com> References: <20260723131242.1537633-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Sashiko AI review pointed out the following issue. The __merge_memory_ranges() function incorrectly handles overlapping memory ranges when merging them. Although sort_memory_ranges() sorts all ranges by their start address in ascending order beforehand, the merge logic remains defective in two ways: 1. It compares the current range's start against the previous element (i-1) instead of the running target index (idx) 2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'. This logic flaw leads to critical memory truncation when a larger memory range completely subsumes subsequent smaller ranges. For example, consider a sorted input array with three ranges: Range A (idx=3D0): [0x1000 - 0x9000] Range B (i=3D1): [0x2000 - 0x5000] (completely inside Range A) Range C (i=3D2): [0x6000 - 0x8000] (completely inside Range A) 1. When i=3D1 (Range B): ranges[1].start (0x2000) <=3D ranges[0].end + 1 (0x9001) is TRUE. The code executes: ranges[0].end =3D ranges[1].end, which erroneously shrinks Range A's end from 0x9000 down to 0x5000. 2. When i=3D2 (Range C): ranges[2].start (0x6000) <=3D ranges[1].end + 1 (0x5001) is FALSE. The code falls into the else block, creating a broken new range. As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000] are completely lost from the kexec exclude lists, potentially allowing the crash kernel to overwrite active memory, causing data corruption or crashes. Fix this by ensuring the start of the current range is compared against the end of the active merged range (idx), and use max() to safely prevent the outer boundary from being truncated. Cc: Sourabh Jain Cc: Hari Bathini Cc: Michael Ellerman Cc: stable@vger.kernel.org Fixes: 180adfc532a8 ("powerpc/kexec_file: Add helper functions for getting = memory ranges") Signed-off-by: Jinjie Ruan --- arch/powerpc/kexec/ranges.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/arch/powerpc/kexec/ranges.c b/arch/powerpc/kexec/ranges.c index e5fea23b191b..539061d14a77 100644 --- a/arch/powerpc/kexec/ranges.c +++ b/arch/powerpc/kexec/ranges.c @@ -21,6 +21,7 @@ #include #include #include +#include #include #include #include @@ -105,19 +106,16 @@ static void __merge_memory_ranges(struct crash_mem *m= em_rngs) struct range *ranges; int i, idx; =20 - if (!mem_rngs) + if (!mem_rngs || mem_rngs->nr_ranges <=3D 1) return; =20 idx =3D 0; - ranges =3D &(mem_rngs->ranges[0]); + ranges =3D mem_rngs->ranges; for (i =3D 1; i < mem_rngs->nr_ranges; i++) { - if (ranges[i].start <=3D (ranges[i-1].end + 1)) - ranges[idx].end =3D ranges[i].end; + if (ranges[i].start <=3D (ranges[idx].end + 1)) + ranges[idx].end =3D max(ranges[idx].end, ranges[i].end); else { idx++; - if (i =3D=3D idx) - continue; - ranges[idx] =3D ranges[i]; } } --=20 2.34.1 From nobody Fri Jul 24 05:23:04 2026 Received: from canpmsgout02.his.huawei.com (canpmsgout02.his.huawei.com [113.46.200.217]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA2564137AF for ; Thu, 23 Jul 2026 13:12:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.217 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812370; cv=none; b=jeTQLgei6v7UsLX7Snw5RMB+JvGVzpGnyC9gKZ8u8Otn1TwlYWlHyZbopfAXrvkYIVjuxSZZqbd9q/FEKpYc8/AD8YAx/ggJOTeb3XCa2Qbxnun2m6VZJhURtEDnnNhDbgxLAHRNH/+o6p98cWJUFNNM0vxTqfcDt9rn3q3OEeQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812370; c=relaxed/simple; bh=GWalRUmW8szyccpxNV/vyP1ET6KqcPeSRWJIw3tb/iI=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=JgTjZhNWyefnFWR+CL72XF5LUjIpkgQiCLnGPrT3qlpjR8Jy+pl68DqTN2OSa+pkTtCQjJeOWMxKE5Gc1vyb0nG9wtsKk+3SnNZ/d6FdFLepV6dbxWOX2V269IRNm9VNaCslkE/9tF4urtoXGQkn6LfdwNZddYWhD8Rk4Yt4ws8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=XGEdLd7O; arc=none smtp.client-ip=113.46.200.217 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="XGEdLd7O" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=svFv2eXHvQP7UCoP9HFVS9Hsbo7FO4p9XBWC3JmSiWc=; b=XGEdLd7OAR0H3Dn8+3Ook/xrlXJPfEpt7brFekxCYXcgV3PegYljnRfapD6Ek55C28katN2Ia 0q7UnqevxOJ66e2ne2H5BLSOgsDUjZ5k5q5lc3/TAYrA+V70dWXMRbgALriylcKzZYtL7A6FsTC 5SL8jQqu1LEv6xlCsi8rQok= Received: from mail.maildlp.com (unknown [172.19.162.197]) by canpmsgout02.his.huawei.com (SkyGuard) with ESMTPS id 4h5WWh35gFzcb2y; Thu, 23 Jul 2026 21:03:12 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 4DB3A4057D; Thu, 23 Jul 2026 21:12:43 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 23 Jul 2026 21:12:41 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH 4/8] kexec: Extract kexec_free_segment_cma() from kimage_free_cma() Date: Thu, 23 Jul 2026 21:12:38 +0800 Message-ID: <20260723131242.1537633-5-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723131242.1537633-1-ruanjinjie@huawei.com> References: <20260723131242.1537633-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" The generic kimage_free_cma() relies on `image->nr_segments` to iterate and free allocated CMA pages. However, during architecture-specific segment placement retry loops (e.g., arm64's image_load()), a mid-way failure will truncate `image->nr_segments` back to its initial value. This truncation permanently hides any CMA pages allocated outside the new boundary from global cleanup, causing silent background memory leaks. To allow architecture-specific loaders to execute fine-grained memory reclamation before truncation occurs, extract the single-pass CMA release logic into a dedicated and exported helper: void kexec_free_segment_cma(struct kimage *image, unsigned long idx); Refactor the main kimage_free_cma() to invoke this helper sequentially to maintain backward compatibility while expanding single-slot flexibility. Signed-off-by: Jinjie Ruan --- include/linux/kexec.h | 2 ++ kernel/kexec_core.c | 25 ++++++++++++++----------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 8a22bc9b8c6c..6f1eabda0300 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -532,6 +532,7 @@ extern bool kexec_file_dbg_print; =20 extern void *kimage_map_segment(struct kimage *image, int idx); extern void kimage_unmap_segment(void *buffer); +extern void kexec_free_segment_cma(struct kimage *image, unsigned long idx= ); #else /* !CONFIG_KEXEC_CORE */ struct pt_regs; struct task_struct; @@ -543,6 +544,7 @@ static inline int kexec_crash_loaded(void) { return 0; } static inline void *kimage_map_segment(struct kimage *image, int idx) { return NULL; } static inline void kimage_unmap_segment(void *buffer) { } +static inline void kexec_free_segment_cma(struct kimage *image, unsigned l= ong idx) { } #define kexec_in_progress false #endif /* CONFIG_KEXEC_CORE */ =20 diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index dc770b9a6d05..ec7e86e085b0 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -554,22 +554,25 @@ static void kimage_free_entry(kimage_entry_t entry) kimage_free_pages(page); } =20 -static void kimage_free_cma(struct kimage *image) +void kexec_free_segment_cma(struct kimage *image, unsigned long idx) { - unsigned long i; + u32 nr_pages =3D image->segment[idx].memsz >> PAGE_SHIFT; + struct page *cma =3D image->segment_cma[idx]; =20 - for (i =3D 0; i < image->nr_segments; i++) { - struct page *cma =3D image->segment_cma[i]; - u32 nr_pages =3D image->segment[i].memsz >> PAGE_SHIFT; + if (!cma) + return; =20 - if (!cma) - continue; + arch_kexec_pre_free_pages(page_address(cma), nr_pages); + dma_release_from_contiguous(NULL, cma, nr_pages); + image->segment_cma[idx] =3D NULL; +} =20 - arch_kexec_pre_free_pages(page_address(cma), nr_pages); - dma_release_from_contiguous(NULL, cma, nr_pages); - image->segment_cma[i] =3D NULL; - } +static void kimage_free_cma(struct kimage *image) +{ + unsigned long i; =20 + for (i =3D 0; i < image->nr_segments; i++) + kexec_free_segment_cma(image, i); } =20 void kimage_free(struct kimage *image) --=20 2.34.1 From nobody Fri Jul 24 05:23:04 2026 Received: from canpmsgout03.his.huawei.com (canpmsgout03.his.huawei.com [113.46.200.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D7A043B6EB for ; Thu, 23 Jul 2026 13:12:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.218 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812377; cv=none; b=epOVU2+0Q/3sAOpB9mMhhvwX+fKSQI8JQfN2DtcaQ/CZaw/2PapKAcMKBvNdHuurrPWvwxlD6Zub1PFzPy+GbwQYjkpKqqMATaPXpVCvb28WSf8tagyOs2Hk1bT6sPjYmjOuZ5VJSvqPMiw37BzwpTrCfWVX1tnZsMVWKCJN4YE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812377; c=relaxed/simple; bh=BL0xK60BvH9iUsdzWa0a34QAmgjV/n5PDm9ELgVvVx8=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=pC8JDXZHcTMybuigJiOrDNgTpJMgvr8Xy3NaNF7tb8o/Diez+xY4szbXEKSQ/T06Wp3Uv3qksPIc6RXHVchr/Slyq4A3r6hcNUC4DukhCBSMCvxTouJr0on2MkiBMV4EYDIZXv4lRrzr8ZX/nk9FQlZa1jYGcIIyudPKq0S/LJY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=xrXL96KM; arc=none smtp.client-ip=113.46.200.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="xrXL96KM" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=XBRyczQwUicQtBBF1Rfna0wwogsOMJkyennASZbUqG0=; b=xrXL96KMqhACloc5kZ0eU2CaXFKslQqforMcwbaswUh74FG5EwH0b3dSRzgaZd34mKBmBongL mBF3AnK/w4jpfBEJwjtyu2ylTcTT9snI7+G3oZot7nUJoLyF5FW8OrsIL1K/i9X8eeNqE1TXLnJ 3AWjsUMYGnE+d+EzlGzbFqA= Received: from mail.maildlp.com (unknown [172.19.162.197]) by canpmsgout03.his.huawei.com (SkyGuard) with ESMTPS id 4h5WXB1VM1zpStj; Thu, 23 Jul 2026 21:03:38 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 2F4014057D; Thu, 23 Jul 2026 21:12:45 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 23 Jul 2026 21:12:43 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH 5/8] arm64: kexec_file: Fix CMA page leaks in segment placement retry loops Date: Thu, 23 Jul 2026 21:12:39 +0800 Message-ID: <20260723131242.1537633-6-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723131242.1537633-1-ruanjinjie@huawei.com> References: <20260723131242.1537633-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Sashiko AI code review pointed out, during kexec image placement retry loops in image_load(), the loader attempts to find a suitable memory hole for the kernel and its associated segments (initrd, dtb, etc.). When a placement attempt fails midway, it restores `image->nr_segments` to its initial state to purge failed segments. However, this truncation causes a memory leak. Any CMA pages allocated via kexec_add_buffer() during the failed attempt are tracked in the `image->segment_cma` array. Because the subsequent cleanup kimage_free_cma() cleanup only iterates up to the truncated `nr_segments` boundary, these allocated CMA pages outside the new boundary permanently leaked. Fix this by using kexec_free_segment_cma() to explicitly release the associated CMA buffers in the failure paths before `image->nr_segments` is reduced. Cc: Catalin Marinas Cc: Will Deacon Cc: Breno Leitao Cc: Pratyush Yadav Cc: Andrew Morton Cc: Yeoreum Yun Cc: Kees Cook Cc: "Rob Herring (Arm)" Cc: Baoquan He Cc: Coiby Xu Cc: Alexander Graf Cc: Pasha Tatashin Cc: stable@vger.kernel.org Fixes: 07d24902977e4 ("kexec: enable CMA based contiguous allocation") Signed-off-by: Jinjie Ruan --- arch/arm64/kernel/kexec_image.c | 1 + arch/arm64/kernel/machine_kexec_file.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_imag= e.c index b70f4df15a1a..ffcb7f9075e6 100644 --- a/arch/arm64/kernel/kexec_image.c +++ b/arch/arm64/kernel/kexec_image.c @@ -107,6 +107,7 @@ static void *image_load(struct kimage *image, * We couldn't find space for the other segments; erase the * kernel segment and try the next available hole. */ + kexec_free_segment_cma(image, kernel_segment_number); image->nr_segments -=3D 1; kbuf.buf_min =3D kernel_segment->mem + kernel_segment->memsz; kbuf.mem =3D KEXEC_BUF_MEM_UNKNOWN; diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/mac= hine_kexec_file.c index 854d872dfd0f..e48f29167b38 100644 --- a/arch/arm64/kernel/machine_kexec_file.c +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -179,7 +179,10 @@ int load_other_segments(struct kimage *image, return 0; =20 out_err: - image->nr_segments =3D orig_segments; + while (image->nr_segments > orig_segments) { + kexec_free_segment_cma(image, image->nr_segments - 1); + image->nr_segments--; + } kvfree(dtb); return ret; } --=20 2.34.1 From nobody Fri Jul 24 05:23:04 2026 Received: from canpmsgout09.his.huawei.com (canpmsgout09.his.huawei.com [113.46.200.224]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC6C441F7F2 for ; Thu, 23 Jul 2026 13:12:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.224 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812376; cv=none; b=GvI+VHg5zbC9hjydYIoovp/W2NVswWt4giFpf/w+jyQHL6oR44/p6iAngtjYUG9zutlHm/AveG6Ooh7F+zilgIcrgqpv6USgQ60m4h6TfPPk0OF+vNh9PFNT+zN0Fos3BOvjt5a/xrCJ6WOt600vR5WJ9Hsfe6060DeHBHQayoI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812376; c=relaxed/simple; bh=kRGxRF1+Xt05h2B5HM4mNpE96Dllr+IGcoUR1Ht7DRY=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=bkBf8gCnHGaoBkpm0hol5E/4d2gdnUXzbfh/ePUdZfO7VpguAjDE79PBzki7LihyaLC4NirrD6c5gx737wDr9YiZSPvsOPLXNUWPPSLL6FKy+kt6p6W2vhCZoc+FoPwEALPyYmMaSxI4afBg5mhr5UMrGKcIQtXl+zZXvhFdwUI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=31XQs43c; arc=none smtp.client-ip=113.46.200.224 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="31XQs43c" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=hK7jXFCfDWQmfE1lAfmJ1Za3SQzmPkoVKzIw7WDhIQs=; b=31XQs43cCV6qUL/z+fW/NkDN9h0WcjRSf5EWA/7dfyMRXUhd6y5jYVs6/QTD42C/zM30SYR4/ whaZW45IuDMQuymkmF6F3ZYU9f982Zg01l9E4Ur45WddBKSTgZvoDc1roJNPeL/7kVU6AVyLSxB 1XgVvw5QyX+I6ClfZxod72E= Received: from mail.maildlp.com (unknown [172.19.163.127]) by canpmsgout09.his.huawei.com (SkyGuard) with ESMTPS id 4h5WWx0T82z1cyQd; Thu, 23 Jul 2026 21:03:25 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 05479402AB; Thu, 23 Jul 2026 21:12:47 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 23 Jul 2026 21:12:45 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH 6/8] arm64: kexec_file: Fix image->elf_headers memory leak during retry loop Date: Thu, 23 Jul 2026 21:12:40 +0800 Message-ID: <20260723131242.1537633-7-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723131242.1537633-1-ruanjinjie@huawei.com> References: <20260723131242.1537633-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Sashiko AI code review pointed out a potential memory leak of image->elf_headers when load_other_segments() fails on error paths. When load_other_segments() fails during the arm64 kexec_file file-load path, execution jumps to the out_err label. While this path restores `image->nr_segments`, it returns an error back to the caller without freeing the allocated `image->elf_headers` vmalloc buffer. Consequently, the retry loop in image_load() will allocate new ELF headers on the next iteration and overwrite `image->elf_headers`, permanently leaking the memory blocks allocated in previous iterations. Fix this by explicitly freeing the stale `image->elf_headers` buffer once the new headers buffer is allocated. Cc: Catalin Marinas Cc: Will Deacon Cc: Thomas Huth Cc: Breno Leitao Cc: Andrew Morton Cc: Yeoreum Yun Cc: Coiby Xu Cc: Baoquan He Cc: Kees Cook Cc: Benjamin Gwin Cc: stable@vger.kernel.org Fixes: 108aa503657e ("arm64: kexec_file: try more regions if loading segmen= ts fails") Signed-off-by: Jinjie Ruan --- arch/arm64/kernel/machine_kexec_file.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/mac= hine_kexec_file.c index e48f29167b38..2f750e5f4fcc 100644 --- a/arch/arm64/kernel/machine_kexec_file.c +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -112,6 +112,10 @@ int load_other_segments(struct kimage *image, vfree(headers); goto out_err; } + + if (unlikely(image->elf_headers)) + vfree(image->elf_headers); + image->elf_headers =3D headers; image->elf_load_addr =3D kbuf.mem; image->elf_headers_sz =3D headers_sz; --=20 2.34.1 From nobody Fri Jul 24 05:23:04 2026 Received: from canpmsgout05.his.huawei.com (canpmsgout05.his.huawei.com [113.46.200.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D6E44137A4 for ; Thu, 23 Jul 2026 13:12:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.220 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812378; cv=none; b=JyyCtdv+C/QbLKt5rC7WVriqJWclccqVVJtp2GVv75vyWD9uybxdu1VqrFgMEFVMzTMvSKhYgaJUel4r2oT8mB8Fpz1rVsKEY3mogK0PmwRVNbvOzeuVWEtFcuETHNmtTxU2FLxZEtUeQmClUI8gYyqtXoT3Ndomu0VR5oJTW3Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812378; c=relaxed/simple; bh=nR11gw15gEPJqV1nhrUXuaxK34tfKi9ybnT7zyMFjLE=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=liUXX6FpPPZvwWfmSBHUDI8jGgpttlSCdGnGzlhnENrO7pPK9gmuykjF1HS8XIvt6uZK1zygIIHHXDos1teWzu/7bzl8MMH1wuHZi//AZhbxObyY76qPJoNe2G8gSO2urLPtWfBZbYG3K04agg3KhFqXmK3dxTYT74ex3UjdYNc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=PMkEsVqm; arc=none smtp.client-ip=113.46.200.220 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="PMkEsVqm" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=g6Yc92QoPew3HKCUSB4m4dcNc/Vm+OS2U2S/yW9Jc5s=; b=PMkEsVqm6RFMXPIx5WaZOO4oyxpChpDlu75jTj/srJ2HGDLlOkNp3qiV3qa4CDLyysFBUdUTA nepizQTBGA+aHVCVAVcMVIDuxeZDc/8XC92aP/bkwa/wbPJ/zhPXtRoRs/4/g1V0vbwo5FHpxup cq6AY7K/hd/XyBTFQ92IJpE= Received: from mail.maildlp.com (unknown [172.19.162.144]) by canpmsgout05.his.huawei.com (SkyGuard) with ESMTPS id 4h5WWl4fWDz12LDF; Thu, 23 Jul 2026 21:03:15 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id D040240538; Thu, 23 Jul 2026 21:12:48 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 23 Jul 2026 21:12:46 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH 7/8] arm64: kexec_file: Simplify load_other_segments() Date: Thu, 23 Jul 2026 21:12:41 +0800 Message-ID: <20260723131242.1537633-8-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723131242.1537633-1-ruanjinjie@huawei.com> References: <20260723131242.1537633-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Use `kbuf` fields directly in crash_prepare_headers() so the local variables "headers" and "headers_sz" can be removed. Additionally, assign the allocated buffer to `image->elf_headers` before calling kexec_add_buffer(). If kexec_add_buffer() fails, the explicit vfree() in the error path can be eliminated, as the allocated elf header memory will be automatically freed via `image->elf_headers` in arch_kimage_file_post_load_cleanup(). Cc: Catalin Marinas Cc: Will Deacon Cc: Baoquan He Cc: Breno Leitao Signed-off-by: Jinjie Ruan --- arch/arm64/kernel/machine_kexec_file.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/mac= hine_kexec_file.c index 2f750e5f4fcc..3d907f8ee594 100644 --- a/arch/arm64/kernel/machine_kexec_file.c +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -89,36 +89,30 @@ int load_other_segments(struct kimage *image, kbuf.buf_min =3D kernel_load_addr + kernel_size; =20 #ifdef CONFIG_CRASH_DUMP - /* load elf core header */ - void *headers; - unsigned long headers_sz; if (image->type =3D=3D KEXEC_TYPE_CRASH) { - ret =3D crash_prepare_headers(true, &headers, &headers_sz, NULL); + ret =3D crash_prepare_headers(true, &kbuf.buffer, &kbuf.bufsz, NULL); if (ret) { pr_err("Preparing elf core header failed\n"); goto out_err; } =20 - kbuf.buffer =3D headers; - kbuf.bufsz =3D headers_sz; + if (unlikely(image->elf_headers)) + vfree(image->elf_headers); + + image->elf_headers =3D kbuf.buffer; + image->elf_headers_sz =3D kbuf.bufsz; + kbuf.mem =3D KEXEC_BUF_MEM_UNKNOWN; - kbuf.memsz =3D headers_sz; + kbuf.memsz =3D kbuf.bufsz; kbuf.buf_align =3D SZ_64K; /* largest supported page size */ kbuf.buf_max =3D ULONG_MAX; kbuf.top_down =3D true; =20 ret =3D kexec_add_buffer(&kbuf); - if (ret) { - vfree(headers); + if (ret) goto out_err; - } - - if (unlikely(image->elf_headers)) - vfree(image->elf_headers); =20 - image->elf_headers =3D headers; image->elf_load_addr =3D kbuf.mem; - image->elf_headers_sz =3D headers_sz; =20 kexec_dprintk("Loaded elf core header at 0x%lx bufsz=3D0x%lx memsz=3D0x%= lx\n", image->elf_load_addr, kbuf.bufsz, kbuf.memsz); --=20 2.34.1 From nobody Fri Jul 24 05:23:04 2026 Received: from canpmsgout05.his.huawei.com (canpmsgout05.his.huawei.com [113.46.200.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1007941379C for ; Thu, 23 Jul 2026 13:12:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.220 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812379; cv=none; b=pdTvv8+YgjZPfdWiwH907gh8/Lf+O8g9EjtWi6Eon7hHRsPplbEmxL2hRNsPrUomi0YRBh1eL8Xg3+RiNIPSrDU9BGenwqhjHDj7LPS7XpUliGTI0k2E2inY0mlQTe7oc3a10c/lw7VlCOsHB1Y96JKv3J1vmMPDHzI+fapHIAs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784812379; c=relaxed/simple; bh=ebbZ6vURsbhnX0aKzYwbQ/ex4uSOu9XMhwctx3QpYSM=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=dFft3p9pVhG/N4PAcAZYMvq6j0ePj9ARuIamqCrQZxxuH/8HdKPGPQ4L2Ccry5G/HPHcXGdwByzc8vFYOjSxyLd8U8lVSVOPda1z+ZroMmRn86i8lvmlWUu3M8sd0c6JZSnxWfRSKliyxDNoqkurHqK2H9hNUvzB7TYukvsQ8UQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=eq4xquh3; arc=none smtp.client-ip=113.46.200.220 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="eq4xquh3" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=DwpJfr2TfW5ZcV9VJdTNQmd8jMNOS9Pa5pxsaoQnPQY=; b=eq4xquh3Zh3MM68UJba8oFngr+x+Dbbj1dGjcEMDpdCCY6tpKlerVUPDvZO5Vy97FNH/Q/vGg VF6VPggav+R++AFm115WuRxAUSOeqCnXPHDCGExXcix3GdtKzTes/WDt5TQTNE6OehXAqWUBm03 camWohp9UZDc70R3rGPm7E0= Received: from mail.maildlp.com (unknown [172.19.162.140]) by canpmsgout05.his.huawei.com (SkyGuard) with ESMTPS id 4h5WWn3mfcz12LDF; Thu, 23 Jul 2026 21:03:17 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id AF7CE2025F; Thu, 23 Jul 2026 21:12:50 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 23 Jul 2026 21:12:48 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: [PATCH 8/8] arm64: crash: Add crash hotplug support Date: Thu, 23 Jul 2026 21:12:42 +0800 Message-ID: <20260723131242.1537633-9-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723131242.1537633-1-ruanjinjie@huawei.com> References: <20260723131242.1537633-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" When CPU or memory hotplug events occur, the elfcorehdr in the kdump image becomes stale, potentially leading to incomplete crash dumps. Currently, userspace udev rules reload the entire kdump image upon such events, which is inefficient and leaves kdump inactive for a long time. Commit 247262756121 ("crash: add generic infrastructure for crash hotplug support") introduced a kernel mechanism to update only the elfcorehdr. This patch enables that support for arm64. On arm64, only memory hotplug events require elfcorehdr updates: - Physical CPU hotplug is not supported. - For ACPI based vCPU hotplug [1], the elfcorehdr is built using for_each_possible_cpu(), so no update is needed. The patch: - Adds CONFIG_ARCH_SUPPORTS_CRASH_HOTPLUG (default y). - Implements following arch functions to handle memory hotplug: 1. arch_crash_hotplug_support() 2. arch_crash_get_elfcorehdr_size() 3. arch_crash_handle_hotplug_event() - Moves arch_get_system_nr_ranges() and arch_crash_populate_cmem() from machine_kexec_file.c to crash.c for crash hotplug reuse. Follows the approach of x86 commit ea53ad9cf73b ("x86/crash: add x86 crash hotplug support") and powerpc commit b741092d5976 ("powerpc/crash: add crash CPU hotplug support"). Tested with QEMU [2] virtual machine using: -M virt,acpi=3Don,highmem=3Don -smp cpus=3D1,maxcpus=3D3 -bios /usr/share/edk2/aarch64/QEMU_EFI.fd -m 2G,slots=3D64,maxmem=3D16G Only kexec_file_load path has been tested; kexec_load is expected to work via KEXEC_CRASH_HOTPLUG_SUPPORT flag but not yet verified. Cc: Catalin Marinas Cc: Will Deacon Cc: Baoquan He Cc: "Mike Rapoport (Microsoft)" Cc: Andrew Morton Cc: Breno Leitao Cc: Kees Cook [1]: https://lore.kernel.org/all/20240529133446.28446-1-Jonathan.Cameron@hu= awei.com/ [2]: https://github.com/salil-mehta/qemu.git virt-cpuhp-armv8/rfc-v2 Signed-off-by: Jinjie Ruan --- arch/arm64/Kconfig | 3 + arch/arm64/include/asm/kexec.h | 13 +++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/crash.c | 148 +++++++++++++++++++++++++ arch/arm64/kernel/machine_kexec_file.c | 53 ++++----- 5 files changed, 187 insertions(+), 32 deletions(-) create mode 100644 arch/arm64/kernel/crash.c diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index b3afe0688919..bebebded5b96 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1666,6 +1666,9 @@ config ARCH_DEFAULT_CRASH_DUMP config ARCH_HAS_GENERIC_CRASHKERNEL_RESERVATION def_bool CRASH_RESERVE =20 +config ARCH_SUPPORTS_CRASH_HOTPLUG + def_bool y + config TRANS_TABLE def_bool y depends on HIBERNATION || KEXEC_CORE diff --git a/arch/arm64/include/asm/kexec.h b/arch/arm64/include/asm/kexec.h index 892e5bebda95..4f3d4fc2807e 100644 --- a/arch/arm64/include/asm/kexec.h +++ b/arch/arm64/include/asm/kexec.h @@ -130,6 +130,19 @@ extern int load_other_segments(struct kimage *image, char *cmdline); #endif =20 +#ifdef CONFIG_CRASH_HOTPLUG +#define pnum_hdr_sz(pnum) ((pnum) * sizeof(Elf64_Phdr) + sizeof(Elf64_Ehdr= )) + +void arch_crash_handle_hotplug_event(struct kimage *image, void *arg); +#define arch_crash_handle_hotplug_event arch_crash_handle_hotplug_event + +int arch_crash_hotplug_support(struct kimage *image, unsigned long kexec_f= lags); +#define arch_crash_hotplug_support arch_crash_hotplug_support + +unsigned int arch_crash_get_elfcorehdr_size(void); +#define crash_get_elfcorehdr_size arch_crash_get_elfcorehdr_size +#endif + #endif /* __ASSEMBLER__ */ =20 #endif diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index d2690c3ec528..9bbac452994c 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -64,7 +64,7 @@ obj-$(CONFIG_KEXEC_CORE) +=3D machine_kexec.o relocate_k= ernel.o \ obj-$(CONFIG_KEXEC_FILE) +=3D machine_kexec_file.o kexec_image.o obj-$(CONFIG_ARM64_RELOC_TEST) +=3D arm64-reloc-test.o arm64-reloc-test-y :=3D reloc_test_core.o reloc_test_syms.o -obj-$(CONFIG_CRASH_DUMP) +=3D crash_dump.o +obj-$(CONFIG_CRASH_DUMP) +=3D crash_dump.o crash.o obj-$(CONFIG_VMCORE_INFO) +=3D vmcore_info.o obj-$(CONFIG_ARM_SDE_INTERFACE) +=3D sdei.o obj-$(CONFIG_ARM64_PTR_AUTH) +=3D pointer_auth.o diff --git a/arch/arm64/kernel/crash.c b/arch/arm64/kernel/crash.c new file mode 100644 index 000000000000..4a8d074c49b8 --- /dev/null +++ b/arch/arm64/kernel/crash.c @@ -0,0 +1,148 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Architecture specific functions for kexec based crash dumps. + */ + +#define pr_fmt(fmt) "crash hp: " fmt + +#include +#include +#include +#include +#include +#include + +#include + +#if defined(CONFIG_KEXEC_FILE) || defined(CONFIG_CRASH_HOTPLUG) +unsigned int arch_get_system_nr_ranges(void) +{ + unsigned int nr_ranges =3D 2 + crashk_cma_cnt; /* for exclusion of crashk= ernel region */ + phys_addr_t start, end; + u64 i; + + for_each_mem_range(i, &start, &end) + nr_ranges++; + + return nr_ranges; +} + +int arch_crash_populate_cmem(struct crash_mem *cmem) +{ + phys_addr_t start, end; + u64 i; + + for_each_mem_range(i, &start, &end) { + cmem->ranges[cmem->nr_ranges].start =3D start; + cmem->ranges[cmem->nr_ranges].end =3D end - 1; + cmem->nr_ranges++; + } + + return 0; +} +#endif + +#ifdef CONFIG_CRASH_HOTPLUG +int arch_crash_hotplug_support(struct kimage *image, unsigned long kexec_f= lags) +{ +#ifdef CONFIG_KEXEC_FILE + if (image->file_mode) + return 1; +#endif + /* + * For kexec_load syscall, crash hotplug support requires + * KEXEC_CRASH_HOTPLUG_SUPPORT flag to be passed by userspace. + */ + return kexec_flags & KEXEC_CRASH_HOTPLUG_SUPPORT; +} + +unsigned int arch_crash_get_elfcorehdr_size(void) +{ + unsigned int phdr_cnt; + + /* A program header for possible CPUs, vmcoreinfo and kernel_map */ + phdr_cnt =3D 2 + num_possible_cpus(); + if (IS_ENABLED(CONFIG_MEMORY_HOTPLUG)) + phdr_cnt +=3D CONFIG_CRASH_MAX_MEMORY_RANGES; + + return pnum_hdr_sz(phdr_cnt); +} + +/** + * update_crash_elfcorehdr() - Recreate the elfcorehdr and replace it with= old + * elfcorehdr in the kexec segment array. + * @image: the active struct kimage + */ +static void update_crash_elfcorehdr(struct kimage *image) +{ + void *elfbuf =3D NULL, *old_elfcorehdr; + unsigned long mem, memsz; + unsigned long elfsz =3D 0; + + /* + * Create the new elfcorehdr reflecting the changes to CPU and/or + * memory resources. + */ + if (crash_prepare_headers(true, &elfbuf, &elfsz, NULL)) { + pr_err("unable to create new elfcorehdr"); + goto out; + } + + /* + * Obtain address and size of the elfcorehdr segment, and + * check it against the new elfcorehdr buffer. + */ + mem =3D image->segment[image->elfcorehdr_index].mem; + memsz =3D image->segment[image->elfcorehdr_index].memsz; + if (elfsz > memsz) { + pr_err("update elfcorehdr elfsz %lu > memsz %lu", + elfsz, memsz); + goto out; + } + + /* + * Copy new elfcorehdr over the old elfcorehdr at destination. + */ + old_elfcorehdr =3D (void *)__va(mem); + if (!old_elfcorehdr) { + pr_err("mapping elfcorehdr segment failed\n"); + goto out; + } + + /* + * Temporarily invalidate the crash image while the + * elfcorehdr is updated. + */ + xchg(&kexec_crash_image, NULL); + memcpy((void *)old_elfcorehdr, elfbuf, elfsz); + dcache_clean_inval_poc((unsigned long)old_elfcorehdr, + (unsigned long)old_elfcorehdr + elfsz); + xchg(&kexec_crash_image, image); + pr_debug("updated elfcorehdr\n"); + +out: + vfree(elfbuf); +} + +/** + * arch_crash_handle_hotplug_event() - Handle hotplug elfcorehdr changes + * @image: a pointer to kexec_crash_image + * @arg: struct memory_notify handler for memory hotplug case and + * NULL for CPU hotplug case. + * + * Update the kdump image based on the type of hotplug event: + * - CPU add and remove: No action is needed. + * - Memory add/remove: Update the elfcorehdr to reflect the current memor= y layout. + * + * Prepare the new elfcorehdr and replace the existing elfcorehdr. + */ +void arch_crash_handle_hotplug_event(struct kimage *image, void *arg) +{ + if ((image->file_mode || image->elfcorehdr_updated) && + ((image->hp_action =3D=3D KEXEC_CRASH_HP_ADD_CPU) || + (image->hp_action =3D=3D KEXEC_CRASH_HP_REMOVE_CPU))) + return; + + update_crash_elfcorehdr(image); +} +#endif /* CONFIG_CRASH_HOTPLUG */ diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/mac= hine_kexec_file.c index 3d907f8ee594..35124f10b509 100644 --- a/arch/arm64/kernel/machine_kexec_file.c +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -14,7 +14,6 @@ #include #include #include -#include #include #include #include @@ -39,34 +38,6 @@ int arch_kimage_file_post_load_cleanup(struct kimage *im= age) return kexec_image_post_load_cleanup_default(image); } =20 -#ifdef CONFIG_CRASH_DUMP -unsigned int arch_get_system_nr_ranges(void) -{ - unsigned int nr_ranges =3D 2 + crashk_cma_cnt; /* for exclusion of crashk= ernel region */ - phys_addr_t start, end; - u64 i; - - for_each_mem_range(i, &start, &end) - nr_ranges++; - - return nr_ranges; -} - -int arch_crash_populate_cmem(struct crash_mem *cmem) -{ - phys_addr_t start, end; - u64 i; - - for_each_mem_range(i, &start, &end) { - cmem->ranges[cmem->nr_ranges].start =3D start; - cmem->ranges[cmem->nr_ranges].end =3D end - 1; - cmem->nr_ranges++; - } - - return 0; -} -#endif - /* * Tries to add the initrd and DTB to the image. If it is not possible to = find * valid locations, this function will undo changes to the image and retur= n non @@ -89,8 +60,9 @@ int load_other_segments(struct kimage *image, kbuf.buf_min =3D kernel_load_addr + kernel_size; =20 #ifdef CONFIG_CRASH_DUMP + unsigned long pnum =3D 0; if (image->type =3D=3D KEXEC_TYPE_CRASH) { - ret =3D crash_prepare_headers(true, &kbuf.buffer, &kbuf.bufsz, NULL); + ret =3D crash_prepare_headers(true, &kbuf.buffer, &kbuf.bufsz, &pnum); if (ret) { pr_err("Preparing elf core header failed\n"); goto out_err; @@ -101,9 +73,28 @@ int load_other_segments(struct kimage *image, =20 image->elf_headers =3D kbuf.buffer; image->elf_headers_sz =3D kbuf.bufsz; + kbuf.memsz =3D kbuf.bufsz; + +#ifdef CONFIG_CRASH_HOTPLUG + /* + * The elfcorehdr segment size accounts for VMCOREINFO, kernel_map + * maximum CPUs and maximum memory ranges. + */ + if (IS_ENABLED(CONFIG_MEMORY_HOTPLUG)) + pnum =3D 2 + num_possible_cpus() + CONFIG_CRASH_MAX_MEMORY_RANGES; + else + pnum +=3D 2 + num_possible_cpus(); + + if (pnum < (unsigned long)PN_XNUM) { + kbuf.memsz =3D pnum_hdr_sz(pnum); + image->elf_headers_sz =3D max(kbuf.memsz, kbuf.bufsz); + image->elfcorehdr_index =3D image->nr_segments; + } else { + pr_err("number of Phdrs %lu exceeds max\n", pnum); + } +#endif =20 kbuf.mem =3D KEXEC_BUF_MEM_UNKNOWN; - kbuf.memsz =3D kbuf.bufsz; kbuf.buf_align =3D SZ_64K; /* largest supported page size */ kbuf.buf_max =3D ULONG_MAX; kbuf.top_down =3D true; --=20 2.34.1