Re: [PATCH v4 09/10] riscv: kdump: exclude non-dumpable reserved memory regions from vmcore

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Concurrent memory hotplug between two `walk_system_ram_res()` calls creates a race condition leading to an out-of-bounds array write in `prepare_elf64_ram_headers_callback()`.
--

commit a4a73b4654fd97d90e65198367a18f9dc30631b2
Author: Wandun Chen <chenwandun@lixiang.com>

riscv: kdump: exclude non-dumpable reserved memory regions from vmcore

This commit applies non-dumpable reserved memory filtering to RISC-V kdump,
similar to arm64. It excludes flagged regions from the elfcorehdr PT_LOAD
segments and pre-sizes the crash_mem array accordingly.

> diff --git a/arch/riscv/kernel/machine_kexec_file.c b/arch/riscv/kernel/machine_kexec_file.c
> index 59d4bbc848a89..25359d583bc3b 100644
> --- a/arch/riscv/kernel/machine_kexec_file.c
> +++ b/arch/riscv/kernel/machine_kexec_file.c
[ ... ]
> @@ -64,6 +65,7 @@ static int prepare_elf_headers(void **addr, unsigned long *sz)
>  
>  	nr_ranges = 1; /* For exclusion of crashkernel region */
>  	walk_system_ram_res(0, -1, &nr_ranges, get_nr_ram_ranges_callback);
> +	nr_ranges += of_reserved_mem_kdump_nr_ranges();
>  
>  	cmem = kmalloc_flex(*cmem, ranges, nr_ranges);
>  	if (!cmem)

[Severity: High]
This is a pre-existing issue, but is it possible for a memory hotplug event
to occur between counting the ranges here and when the array is actually
populated?

In prepare_elf_headers(), the code counts the memory ranges to allocate
the cmem array, but a concurrent memory hot-add could occur before the
subsequent walk_system_ram_res() call populates it:

arch/riscv/kernel/machine_kexec_file.c:prepare_elf_headers() {
    ...
    walk_system_ram_res(0, -1, &nr_ranges, get_nr_ram_ranges_callback);
    ...
    ret = walk_system_ram_res(0, -1, cmem, prepare_elf64_ram_headers_callback);
    ...
}

If the number of ranges increases, prepare_elf64_ram_headers_callback()
will write past the end of the flexible array since it doesn't verify
that cmem->nr_ranges is less than cmem->max_nr_ranges:

arch/riscv/kernel/machine_kexec_file.c:prepare_elf64_ram_headers_callback() {
    ...
    cmem->ranges[cmem->nr_ranges].start = res->start;
    cmem->ranges[cmem->nr_ranges].end = res->end;
    cmem->nr_ranges++;
    ...
}

Could this missing bounds check lead to an out-of-bounds heap write?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630074715.4126796-1-chenwandun1@gmail.com?part=9