Re: [PATCH v4 10/10] loongarch: kdump: exclude non-dumpable reserved memory regions from vmcore

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Concurrent memory hotplug during kexec_file_load() can cause an out-of-bounds write in the `cmem->ranges` array due to a TOCTOU between two lockless passes of `for_each_mem_range()`.
--

commit d8948c2d581027666a36bbb47058ae244b39b8ae
Author: Wandun Chen <chenwandun@lixiang.com>

loongarch: kdump: exclude non-dumpable reserved memory regions from vmcore

This commit applies the arm64 non-dumpable reserved memory filtering to
LoongArch kdump. It uses of_reserved_mem_kdump_nr_ranges() to size the 
crash_mem array and of_reserved_mem_kdump_exclude() to drop regions.

> diff --git a/arch/loongarch/kernel/machine_kexec_file.c b/arch/loongarch/kernel/machine_kexec_file.c
> index 5584b798ba464..4b918c3d4a285 100644
> --- a/arch/loongarch/kernel/machine_kexec_file.c
> +++ b/arch/loongarch/kernel/machine_kexec_file.c
[ ... ]
> @@ -67,6 +68,7 @@ static int prepare_elf_headers(void **addr, unsigned long *sz)
>  	nr_ranges = 2; /* for exclusion of crashkernel region */
>  	for_each_mem_range(i, &start, &end)
>  		nr_ranges++;
> +	nr_ranges += of_reserved_mem_kdump_nr_ranges();
>  
>  	cmem = kmalloc_flex(*cmem, ranges, nr_ranges);
>  	if (!cmem)

[Severity: High]
This is a pre-existing issue, but can concurrent memory hotplug during
kexec_file_load() cause an out-of-bounds write in the cmem->ranges array?

If the number of memory regions increases between the first lockless pass
of for_each_mem_range() shown above, and the second lockless pass that
populates the array later in prepare_elf_headers():

	for_each_mem_range(i, &start, &end) {
		cmem->ranges[cmem->nr_ranges].start = start;
		cmem->ranges[cmem->nr_ranges].end = end - 1;
		cmem->nr_ranges++;
	}

could the second pass write past the allocated cmem->ranges array?

Since kexec_file_load() takes kexec_mutex while memory hotplug uses
mem_hotplug_lock, they can run concurrently. A concurrent addition via
memblock_add_node() could result in writing beyond the bounds of the array.
Should there be bounds checking when adding ranges to the array in the
second pass?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630074715.4126796-1-chenwandun1@gmail.com?part=10