Re: [PATCH v15 15/23] crash: Add crash_prepare_headers() to exclude crash kernel memory

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Lockless traversal of memblock regions during kexec_file_load races with memory hotplug, leading to Use-After-Free.
--

commit 4f0896f6bb8685cdb345e9a9e54c301abdd1086a
Author: Jinjie Ruan <ruanjinjie@huawei.com>

crash: Add crash_prepare_headers() to exclude crash kernel memory

This commit introduces crash_prepare_headers() to consolidate memory allocation 
and crash kernel exclusion logic across architectures. It adds three weak 
architecture-specific callbacks to handle counting, populating, and excluding 
crash memory ranges.

> diff --git a/kernel/crash_core.c b/kernel/crash_core.c
> index 4f21fc3b108b8..481babc291310 100644
> --- a/kernel/crash_core.c
> +++ b/kernel/crash_core.c

[ ... ]

> @@ -272,6 +269,85 @@ int crash_prepare_elf64_headers(struct crash_mem *mem, int need_kernel_map,
>  	return 0;
>  }
>  

[ ... ]

> +int crash_prepare_headers(int need_kernel_map, void **addr, unsigned long *sz,
> +			  unsigned long *nr_mem_ranges)
> +{
> +	unsigned int max_nr_ranges;
> +	struct crash_mem *cmem;
> +	int ret;
> +
> +	max_nr_ranges = arch_get_system_nr_ranges();

[Severity: High]
This is a pre-existing issue, but can this lockless architecture callback
trigger a Use-After-Free during concurrent memory hotplug?

In the kexec_file_load() path, we don't seem to hold mem_hotplug_lock
(via get_online_mems()). When architectures implement arch_get_system_nr_ranges()
they typically iterate over memblock.memory.regions locklessly:

arch_get_system_nr_ranges() {
    ...
    for_each_mem_range(i, &start, &end)
        nr_ranges++;
    ...
}

If a concurrent memory hotplug operation calls add_memory_resource() and
the memblock regions array is full, memblock_double_array() will allocate a
new array and free the old array via kfree(). 

Does this allow the lockless kexec iteration to dereference a freed regions 
array, crashing the system when concurrently hot-plugging memory and loading 
a kexec crash kernel?

> +	if (!max_nr_ranges)
> +		return -ENOMEM;
> +
> +	cmem = alloc_cmem(max_nr_ranges);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260601094805.2928614-1-ruanjinjie@huawei.com?part=15