Re: [PATCH v17 01/10] riscv: kexec_file: Fix crashk_low_res not exclude bug

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] A Time-of-Check to Time-of-Use (TOCTOU) race condition between counting system RAM ranges and populating them can lead to a heap buffer overflow in `prepare_elf64_ram_headers_callback()`.
--

commit d55f858d6c28d0bc9c6e0e425332f4e2b5fea19b
Author: Jinjie Ruan <ruanjinjie@huawei.com>

riscv: kexec_file: Fix crashk_low_res not exclude bug

This commit fixes a bug in the riscv kdump implementation where the
crashk_low_res reserved ranges were not excluded from the crash kernel
memory. It updates the number of reserved ranges and excludes the
low memory range to prevent it from being exported through /proc/vmcore.

Link: https://github.com/chenjh005/kexec-tools/tree/build-test-riscv-v2
Link: https://lore.kernel.org/all/20230726175000.2536220-1-chenjiahao16@huawei.com/

> diff --git a/arch/riscv/kernel/machine_kexec_file.c b/arch/riscv/kernel/machine_kexec_file.c
> index 54e2d9552e930..3f7766057cac3 100644
> --- a/arch/riscv/kernel/machine_kexec_file.c
> +++ b/arch/riscv/kernel/machine_kexec_file.c
> @@ -61,7 +61,7 @@ static int prepare_elf_headers(void **addr, unsigned long *sz)
>  	unsigned int nr_ranges;
>  	int ret;
>  
> -	nr_ranges = 1; /* For exclusion of crashkernel region */
> +	nr_ranges = 2; /* For exclusion of crashkernel region */
>  	walk_system_ram_res(0, -1, &nr_ranges, get_nr_ram_ranges_callback);
>  
>  	cmem = kmalloc_flex(*cmem, ranges, nr_ranges);

[Severity: High]
This is a pre-existing issue, but what happens if memory is hot-added
concurrently between the first and second calls to walk_system_ram_res()
in prepare_elf_headers()?

If the number of RAM ranges increases after the first walk computes the
allocation size, the second walk will invoke
prepare_elf64_ram_headers_callback() more times than the allocated capacity.

Looking at prepare_elf64_ram_headers_callback(), there is no bounds check
against cmem->max_nr_ranges:

static int prepare_elf64_ram_headers_callback(struct resource *res, void *arg)
{
        struct crash_mem *cmem = arg;

        cmem->ranges[cmem->nr_ranges].start = res->start;
        cmem->ranges[cmem->nr_ranges].end = res->end;
        cmem->nr_ranges++;

        return 0;
}

Could this cause a heap buffer overflow if the number of new regions exceeds
the padding reserved for exclusion ranges?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629094746.191843-1-ruanjinjie@huawei.com?part=1