Re: [PATCH v4 08/10] arm64: kdump: exclude non-dumpable reserved memory regions from vmcore

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Preexisting TOCTOU race in prepare_elf_headers() during memblock iteration can cause an out-of-bounds array write due to concurrent memory hotplug.
--

commit 66936af0a692eab34029fe4f8b5ede43875e861f
Author: Wandun Chen <chenwandun@lixiang.com>
Date:   Tue Jun 30 07:47:12 2026 +0000

arm64: kdump: exclude non-dumpable reserved memory regions from vmcore
    
This commit excludes reserved memory regions from the vmcore unless they are
explicitly marked as dumpable. It uses device tree reservations to filter
out device firmware regions, reducing the size of the vmcore. The array
size is adjusted to accommodate these exclusions.

> diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
> index e31fabed378a5..1d65320c6ba48 100644
> --- a/arch/arm64/kernel/machine_kexec_file.c
> +++ b/arch/arm64/kernel/machine_kexec_file.c
[ ... ]
> @@ -51,6 +52,7 @@ static int prepare_elf_headers(void **addr, unsigned long *sz)
>  	nr_ranges = 2; /* for exclusion of crashkernel region */
>  	for_each_mem_range(i, &start, &end)
>  		nr_ranges++;
> +	nr_ranges += of_reserved_mem_kdump_nr_ranges();
>  
>  	cmem = kmalloc_flex(*cmem, ranges, nr_ranges);
>  	if (!cmem)

[Severity: High]
This isn't a bug introduced by this patch, but could this allocation lead to
an out-of-bounds write due to a time-of-check to time-of-use race?

In prepare_elf_headers(), the code counts the memory ranges with a first
for_each_mem_range() loop, allocates cmem based on that count, and then
populates cmem->ranges in a second for_each_mem_range() loop further down.

Because sys_kexec_file_load() does not hold the memory hotplug lock, a
concurrent memory hotplug operation could increase the number of ranges
between the two loops.

Since the second loop does not verify if cmem->nr_ranges exceeds
cmem->max_nr_ranges, could it write past the allocated array bounds?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630074715.4126796-1-chenwandun1@gmail.com?part=8