Re: [PATCH v5 3/3] arm64,ppc64le/kdump: pass dm-crypt keys to kdump kernel

Andrew Morton
2026-04-03T06:31:20Z

On Thu, 2 Apr 2026 16:24:14 +0530 Sourabh Jain <sourabhjain@linux.ibm.com> wrote:

> But while reading crash_load_dm_crypt_keys() I noticed a possibility of a
> double free at the address pointed by `keys_header`:
>
> In crash_load_dm_crypt_keys()/crash_dump_dm_crypt.c
>     snip...
>
>     kbuf.buffer = keys_header;
>
>     snip....
>
>     r = kexec_add_buffer(&kbuf);
>     if (r) {
>         pr_err("Failed to call kexec_add_buffer, ret=%d\n", r);
>         kvfree((void *)kbuf.buffer);                           <---
> First Free
>         return r;
>     }
>
> Since `keys_header` is not reset, the next call to build_keys_header()
> will cause a double free at `keys_header`.
>
> static int build_keys_header(void)
> {
>
>     snip...
>
>     if (keys_header != NULL)
>         kvfree(keys_header);
>
>     snip...
> }
>
> What do you think?

It looks that way to me.