Re: [PATCH v2 5/8] of: reserved_mem: add kdump helpers to exclude non-dumpable regions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free when accessing `reserved_mem` during kexec load on systems with `/memreserve/` but no `/reserved-memory` node.
--

commit f3d66a3fdb2eb02781d662efcbf6e92d5a51228e
Author: Wandun Chen <chenwandun1@gmail.com>

of: reserved_mem: add kdump helpers to exclude non-dumpable regions

This commit adds two helpers to exclude non-dumpable reserved memory
regions during kdump. These helpers calculate the number of excluded
ranges and perform the actual exclusion by iterating over the
reserved_mem array.

> diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
> --- a/drivers/of/of_reserved_mem.c
> +++ b/drivers/of/of_reserved_mem.c

[ ... ]

> +/* Exclude non-dumpable reserved regions from @cmem. */
> +int of_reserved_mem_kdump_exclude(struct crash_mem *cmem)
> +{
> +	unsigned int i;
> +	int ret;
> +
> +	for (i = 0; i < reserved_mem_count; i++) {
> +		struct reserved_mem *r = &reserved_mem[i];

[Severity: High]
Can accessing reserved_mem here cause a use-after-free on systems that have
/memreserve/ entries but no /reserved-memory node?

The global pointer reserved_mem initially points to reserved_mem_array,
which is marked with __initdata. During early boot, if there is no
/reserved-memory node, fdt_scan_reserved_mem_late() returns early without
dynamically allocating a permanent array.

However, fdt_reserved_mem_save_memreserve_entries() unconditionally
populates /memreserve/ entries into this __initdata array and increments
reserved_mem_count.

After boot completes, the __initdata section is freed.

When a kexec image is later loaded, won't these helpers iterate over
reserved_mem_count and read fields like size, dumpable, and base from
the freed init memory?

> +
> +		if (!r->size || r->dumpable)
> +			continue;
> +		ret = crash_exclude_mem_range(cmem, r->base,
> +					      r->base + r->size - 1);
> +		if (ret)
> +			return ret;
> +	}
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260520091844.592753-1-chenwandun@lixiang.com?part=5