Re: [PATCH v15 06/23] kexec: Extract kexec_free_segment_cma() from kimage_free_cma()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] kimage_load_cma_segment() leaves the trailing padding of CMA segments uninitialized, causing kexec purgatory SHA256 verification failures.
--

commit a9d6d83b4aab10c874e37c5a865249c7645d1e82
Author: Jinjie Ruan <ruanjinjie@huawei.com>

kexec: Extract kexec_free_segment_cma() from kimage_free_cma()

This patch extracts the single-pass CMA release logic into a dedicated exported
helper kexec_free_segment_cma(). It refactors the main kimage_free_cma() to
invoke this helper sequentially to maintain backward compatibility while
expanding single-slot flexibility.

> diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
> index a43d2da0fe3e7..9195f81e53c48 100644
> --- a/kernel/kexec_core.c
> +++ b/kernel/kexec_core.c
[ ... ]
> -static void kimage_free_cma(struct kimage *image)
> +void kexec_free_segment_cma(struct kimage *image, unsigned long idx)
>  {
> -	unsigned long i;
> +	u32 nr_pages = image->segment[idx].memsz >> PAGE_SHIFT;
> +	struct page *cma = image->segment_cma[idx];
[ ... ]
> +	arch_kexec_pre_free_pages(page_address(cma), nr_pages);
> +	dma_release_from_contiguous(NULL, cma, nr_pages);
> +	image->segment_cma[idx] = NULL;
> +}

While reviewing this patch, I noticed a pre-existing issue in the related
kimage_load_cma_segment() function in the same file:

kernel/kexec_core.c:kimage_load_cma_segment() {
    ...
	/* Then copy from source buffer to the CMA one */
	while (mbytes) {
		size_t uchunk, mchunk;
    ...
		ptr    += mchunk;
		mbytes -= mchunk;

		cond_resched();
	}

	/* Clear any remainder */
	memset(ptr, 0, mbytes);
    ...
}

[Severity: High]
This isn't a bug introduced by this patch, but does this memset actually clear
the trailing padding?

The while loop terminates when mbytes reaches 0, which translates the memset
to memset(ptr, 0, 0). Because kexec purgatory calculates the SHA256 digest of
the entire segment assuming the padding is zeroed, could the uninitialized
memory lead to a digest mismatch and cause kexec boot failures?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260601094805.2928614-1-ruanjinjie@huawei.com?part=6