Re: [PATCH v1 2/8] s390/kdump: Reserve crashkernel CMA memory

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] s390/kdump: reserve_crashkernel() allows CMA allocation in
  [0, crash_size)
--

commit 8b228cd4036f52fccdf6ce96ff9330544194ef3d
Author: Mikhail Zaslonko <zaslonko@linux.ibm.com>

s390/kdump: Reserve crashkernel CMA memory

This commit parses the ",cma" suffix of the crashkernel= command-line
parameter on s390 and reserves the requested CMA memory via
reserve_crashkernel_cma() when not booting as a kdump kernel.

> diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
> index b60284328fe3d..0251bd35954a8 100644
> --- a/arch/s390/kernel/setup.c
> +++ b/arch/s390/kernel/setup.c
> @@ -598,12 +598,12 @@ static void __init reserve_pgtables(void)
>  static void __init reserve_crashkernel(void)
>  {
>  #ifdef CONFIG_CRASH_DUMP
> -	unsigned long long crash_base, crash_size;
> +	unsigned long long crash_base, crash_size, cma_size = 0;
>  	phys_addr_t low, high;
>  	int rc;
>  
>  	rc = parse_crashkernel(boot_command_line, ident_map_size,
> -			       &crash_size, &crash_base, NULL, NULL, NULL);
> +			       &crash_size, &crash_base, NULL, &cma_size, NULL);
>  
>  	crash_base = ALIGN(crash_base, KEXEC_CRASH_MEM_ALIGN);
>  	crash_size = ALIGN(crash_size, KEXEC_CRASH_MEM_ALIGN);
> @@ -658,6 +658,13 @@ static void __init reserve_crashkernel(void)
>  		crash_size >> 20, crash_base >> 20,
>  		(unsigned long)memblock.memory.total_size >> 20);
>  	os_info_crashkernel_add(crash_base, crash_size);
> +
> +	/*
> +	 * A kdump kernel is handed the CMA ranges of the crashed kernel
> +	 * instead of reserving its own.
> +	 */
> +	if (!oldmem_data.start)
> +		reserve_crashkernel_cma(cma_size);
>  #endif
>  }

[Severity: Medium]
Can reserve_crashkernel_cma() allocate CMA ranges inside [0, low),
overlapping the [0, crash_size) memory region that purgatory swaps with
[crash_base, crash_base + crash_size) on kdump (or the [0, sclp.hsa_size)
HSA region)?

Earlier in reserve_crashkernel(), crash_base is constrained to sit at or
above low:

arch/s390/kernel/setup.c:reserve_crashkernel() {
	...
		/* Find suitable area in free memory */
		low = max_t(unsigned long, crash_size, sclp.hsa_size);
		high = crash_base ? crash_base + crash_size : ULONG_MAX;
	...
		low = crash_base ?: low;
		crash_base = memblock_phys_alloc_range(crash_size,
						       KEXEC_CRASH_MEM_ALIGN,
						       low, high);
}

However, [0, low) is not reserved in memblock when
reserve_crashkernel_cma() runs, and reserve_crashkernel_cma() calls
cma_declare_contiguous() with base = 0.  When free memory above 4 GB (or
above low) is insufficient for cma_size, cma_alloc_mem() allocates from
[0, low).  In the kdump kernel, any CMA range inside [0, crash_size)
merges with the existing [0, oldmem_data.size) primary memory range
instead of providing the requested extra memory, and a CMA range
straddling crash_size corrupts the swapped memory layout.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112112105.1169118-1-zaslonko@linux.ibm.com?part=2