Re: [PATCH v8 02/11] kexec: Add helpers to load the elf core header, initrd and FDT

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] kexec: conditional elfcorehdr_index update in
  kexec_add_elf_core_header()
--

commit 4a8f51d9037324bff5c93a895d13b625ecd6ac57
Author: Jinjie Ruan <ruanjinjie@huawei.com>

kexec: Add helpers to load the elf core header, initrd and FDT

This commit adds generic kexec_file helpers to prepare and place the ELF
core header, initrd, and flattened device tree segments.

Link: https://lore.kernel.org/all/179430504583.425130.15302016434972990362.b4-review@b4/

> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 1f128c6e6fa39..25c9bef639d27 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c

[ ... ]

> +int kexec_add_elf_core_header(struct kimage *image, struct kexec_buf *kbuf)
> +{
> +	unsigned long memsz = kbuf->memsz;
> +	int ret;
> +
> +	kbuf->buffer = image->elf_headers;
> +	kbuf->bufsz = image->elf_headers_sz;
> +	kbuf->mem = KEXEC_BUF_MEM_UNKNOWN;
> +
> +	ret = kexec_add_buffer(kbuf);
> +	if (ret)
> +		return ret;
> +
> +	image->elf_load_addr = kbuf->mem;
> +
> +	/* The crash hotplug reservation can exceed the header size. */
> +	if (memsz > image->elf_headers_sz) {
> +		image->elf_headers_sz = memsz;
> +#ifdef CONFIG_CRASH_HOTPLUG
> +		image->elfcorehdr_index = image->nr_segments - 1;
> +#endif
> +	}

[Severity: High]
Should image->elfcorehdr_index be set unconditionally under
CONFIG_CRASH_HOTPLUG rather than only when memsz > image->elf_headers_sz?

When a caller passes kbuf->memsz <= image->elf_headers_sz (such as when
kbuf->memsz equals image->elf_headers_sz, or when an unaligned hotplug
size fits within the page-aligned image->elf_headers_sz),
image->elfcorehdr_index remains -1.  kexec_calculate_store_digests() then
hashes the elfcorehdr segment into the purgatory digest, so any later CPU
or memory hotplug update in crash_handle_hotplug_event() rewrites the
header in crash memory and causes purgatory SHA verification to fail on
panic.

Also, if a caller passes kbuf->memsz smaller than image->elf_headers_sz,
clamping kbuf->memsz = max(kbuf->memsz, image->elf_headers_sz) before
kexec_add_buffer() is needed so the segment cannot end up with
memsz < bufsz and fail sanity_check_segment_list() with -EINVAL.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112133418.4044428-1-ruanjinjie@huawei.com?part=2