Re: [PATCH v15 07/23] arm64: kexec_file: Fix CMA page leaks during segment placement retry loops

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] CMA page leak during kimage destruction due to kernel segment memsz truncation
--

commit 92b0521f40a064f818d922d92b679f992a0b9e1d
Author: Jinjie Ruan <ruanjinjie@huawei.com>

arm64: kexec_file: Fix CMA page leaks during segment placement retry loops

This commit addresses CMA memory leaks during arm64 kexec image placement
retry loops. It explicitly calls kexec_free_segment_cma() to release aborted
kernel segments before truncation. It also adds a backward iteration in the
error path of load_other_segments() to free any orphaned allocations.

> diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
> index b70f4df15a1ae..ffcb7f9075e62 100644
> --- a/arch/arm64/kernel/kexec_image.c
> +++ b/arch/arm64/kernel/kexec_image.c
> @@ -107,6 +107,7 @@ static void *image_load(struct kimage *image,
>  		 * We couldn't find space for the other segments; erase the
>  		 * kernel segment and try the next available hole.
>  		 */
> +		kexec_free_segment_cma(image, kernel_segment_number);
>  		image->nr_segments -= 1;
>  		kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz;
>  		kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;

[Severity: High]
This is a pre-existing issue, but could modifying the segment size later in
image_load() cause a CMA leak if the image is later unloaded or if the
syscall fails?

If the segment is successfully placed, the code modifies the segment size:

arch/arm64/kernel/kexec_image.c:image_load() {
    ...
    kernel_segment = &image->segment[kernel_segment_number];
    kernel_segment->mem += text_offset;
    kernel_segment->memsz -= text_offset;
    ...
}

Since kexec_free_segment_cma() computes the number of pages to release by
shifting the now-decremented memsz, will dma_release_from_contiguous()
receive a smaller page count than was originally allocated, permanently
leaking text_offset worth of CMA pages?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260601094805.2928614-1-ruanjinjie@huawei.com?part=7