Re: [PATCH v2 5/8] of: reserved_mem: add kdump helpers to exclude non-dumpable regions

[Wandun <chenwandun1@gmail.com>]

On 5/20/26 19:03, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Use-After-Free when accessing `reserved_mem` during kexec load on systems with `/memreserve/` but no `/reserved-memory` node.
> --
>
> commit f3d66a3fdb2eb02781d662efcbf6e92d5a51228e
> Author: Wandun Chen <chenwandun1@gmail.com>
>
> of: reserved_mem: add kdump helpers to exclude non-dumpable regions
>
> This commit adds two helpers to exclude non-dumpable reserved memory
> regions during kdump. These helpers calculate the number of excluded
> ranges and perform the actual exclusion by iterating over the
> reserved_mem array.
>
>> diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
>> --- a/drivers/of/of_reserved_mem.c
>> +++ b/drivers/of/of_reserved_mem.c
> [ ... ]
>
>> +/* Exclude non-dumpable reserved regions from @cmem. */
>> +int of_reserved_mem_kdump_exclude(struct crash_mem *cmem)
>> +{
>> +	unsigned int i;
>> +	int ret;
>> +
>> +	for (i = 0; i < reserved_mem_count; i++) {
>> +		struct reserved_mem *r = &reserved_mem[i];
> [Severity: High]
> Can accessing reserved_mem here cause a use-after-free on systems that have
> /memreserve/ entries but no /reserved-memory node?
>
> The global pointer reserved_mem initially points to reserved_mem_array,
> which is marked with __initdata. During early boot, if there is no
> /reserved-memory node, fdt_scan_reserved_mem_late() returns early without
> dynamically allocating a permanent array.
>
> However, fdt_reserved_mem_save_memreserve_entries() unconditionally
> populates /memreserve/ entries into this __initdata array and increments
> reserved_mem_count.
>
> After boot completes, the __initdata section is freed.
>
> When a kexec image is later loaded, won't these helpers iterate over
> reserved_mem_count and read fields like size, dumpable, and base from
> the freed init memory?
Yes, it is indeed a UAF issue if no /reserved-memory node.
Will fix in v3
>
>> +
>> +		if (!r->size || r->dumpable)
>> +			continue;
>> +		ret = crash_exclude_mem_range(cmem, r->base,
>> +					      r->base + r->size - 1);
>> +		if (ret)
>> +			return ret;
>> +	}
>> +	return 0;
>> +}