Re: [PATCH v8 09/11] kexec: Add kexec_rollback_segments() helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] kexec: missing elfcorehdr_index invalidation in
  kexec_rollback_segments()
--

commit 67c30192060172d9e9af6c0433ce26a5bea934f3
Author: Jinjie Ruan <ruanjinjie@huawei.com>

kexec: Add kexec_rollback_segments() helper

This commit adds a kexec_rollback_segments() helper to release CMA pages
and truncate image->nr_segments when rolling back a partial load attempt.

> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 25c9bef639d27..b4fe5c4188421 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -1419,3 +1419,15 @@ int kexec_purgatory_get_set_symbol(struct kimage *image, const char *name,
>  	return 0;
>  }
>  #endif /* CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY */
> +
> +/*
> + * Undo a partial load attempt: release the CMA pages backing
> + * the segments above @nr_segments and drop them from the image.
> + */
> +void kexec_rollback_segments(struct kimage *image, unsigned long nr_segments)
> +{
> +	while (image->nr_segments > nr_segments) {
> +		kexec_free_segment_cma(image, image->nr_segments - 1);
> +		image->nr_segments--;
> +	}
> +}

[Severity: Medium]
Does kexec_rollback_segments() leave a stale image->elfcorehdr_index when
the ELF core header segment is among the dropped segments?

The commit message notes that the helper invalidates the recorded
elfcorehdr segment index when dropped, but the implementation does not
reset image->elfcorehdr_index to -1.  Moreover, kexec_add_elf_core_header()
only records image->elfcorehdr_index when memsz > image->elf_headers_sz
and updates image->elf_headers_sz on the first attempt:

kernel/kexec_file.c:kexec_add_elf_core_header() {
	...
	if (memsz > image->elf_headers_sz) {
		image->elf_headers_sz = memsz;
#ifdef CONFIG_CRASH_HOTPLUG
		image->elfcorehdr_index = image->nr_segments - 1;
#endif
	}
	...
}

If a rollback drops the ELF core header segment, a retry sees
memsz == image->elf_headers_sz and leaves the old index in place, causing
kexec_calculate_store_digests() and handle_hotplug_event() to skip or
reference the wrong segment.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112133418.4044428-1-ruanjinjie@huawei.com?part=9