Re: [PATCH v6 00/14] crash: Fix several bugs

[Baoquan He <baoquan.he@linux.dev>]

On 10/08/26 at 09:57am, Jinjie Ruan wrote:
> 
> 
> 在 2026/9/21 17:04, Jinjie Ruan 写道:
> > As Baoquan and Catalin suggested, this patch set fixes
> > several pre-existing code issues found by Sashiko AI [1][2][3].
> > 
> > The major improvements and fixes included in this series are:
> > - Fix several memory leaks for arm64, and similar issues on LoongArch.
> > - Fix out-of-bounds write on 32-bit Highmem for x86.
> > - Fix TOCTOU race in crash memory range collection.
> 
> Hi all,
> 
> Gentle ping.
> 
> Could anyone take a look or let me know if there's anything
> else needed? I can rebase/resend if required.

They may need reviewing and ack from different arch. E.g patch 1,
even though it's changed in kernel/kexec_core.c, the arm64 specific
handling need be checked and confirmed by arm64 expert.

I can review changes in generic code and arch I am familiar with, while
those part I am unfamiliar with need be reviewed by experts of specific
area.

> 
> > 
> > This patch set is rebased on v7.3-rc3. Compared to the previous version,
> > split out arm64 crash hotplug patches as Breno suggested, which are based
> > on these bugfix patches and will be resubmitted after this patch series
> > is merged.
> > 
> > Slightly tested on x86_64 and arm64 qemu with:
> > - kexec_load (--kexec-syscall --hotplug)
> > - kexec_load (--kexec-file-syscall)
> > 
> > All boot successfully into the second kernel.
> > 
> > [1]: https://lore.kernel.org/all/20260601094805.2928614-1-ruanjinjie@huawei.com/
> > [2]: https://sashiko.dev/#/patchset/20260729031235.2840255-1-ruanjinjie%40huawei.com
> > [3]: https://sashiko.dev/#/patchset/20260907125404.922123-1-ruanjinjie%40huawei.com
> > 
> > Changes in v6:
> > - Split out arm64 crash hotplug patches as Breno suggested.
> > - Remove unused elfcorehdr_updated [4].
> > - Make the patch split more clear.
> > - Link to v5: https://lore.kernel.org/all/20260918100442.3841135-1-ruanjinjie@huawei.com/
> > 
> > [4]: https://sashiko.dev/#/patchset/20260907125404.922123-1-ruanjinjie%40huawei.com
> > 
> > Changs in v5:
> > - Rebased on v7.3-rc3.
> > - Fix several pre-existing code issues reported by Sashiko AI review. [3]
> > - Add an extra slot for memory hot-unplug.
> > - Add device_hotplug_lock_assert_held() helper.
> > - Rework to let the hotplug paths to skip CPU events entirely, which avoid
> >   the TOCTOU race of memory hotplug events and internal CPU offline path
> >   without holding device_hotplug_lock.
> > - Link to v4: https://lore.kernel.org/all/20260907125404.922123-1-ruanjinjie@huawei.com/
> > 
> > Changes in v4:
> > - Rebased on v7.3-rc1.
> > - Update the kexec_core code as Mike suggested.
> > - Update the LoongArch subject as Huacai suggested.
> > - Drop crash_dump_dm_crypt patch which will be fixed by Coiby in [4] as
> >   Sourabh suggested.
> > - Drop x86 related patches because of branch conflict, which will
> >   be done later.
> > - Drop the incorrect CRASH_MAX_MEMORY_RANGES patch.
> > - Handle elfcorehdr_index in arm64 arch code.
> > - Link to v3: https://lore.kernel.org/all/20260826092541.3905933-1-ruanjinjie@huawei.com/
> > 
> > [4] https://lore.kernel.org/all/20260828084900.1496839-2-coiby.xu@gmail.com/
> > 
> > Changes in v3:
> > - Handle "KEXEC_CRASH_HP_REMOVE_MEMORY" action.
> > - Fix several pre-existing code issues reported by Sashiko AI review [3].
> > - Introduce crash_extra_elfcorehdr_size() and elf64_phdr_size() helper.
> > - Rework related crash and arch code.
> > - Add test method.
> > - v2: https://lore.kernel.org/all/20260729031235.2840255-1-ruanjinjie@huawei.com/
> > 
> > Changes in v2:
> > - Split out Powerpc bugfix patch as Mike suggested.
> > - Use phys_to_virt() instead of __va() in update_crash_elfcorehdr().
> > - Convert pnum_hdr_sz() to a function.
> > - Only assign elfcorehdr_index after kexec_add_buffer succeeds, considering
> >   crash_handle_hotplug_event() already performs validity check on
> >   elfcorehdr_index:
> >   - We can safely remove the check for CPU hotplug
> >     in arch_crash_handle_hotplug_event().
> >   - The elfcorehdr_index's segment mem will be valid in
> >     update_crash_elfcorehdr(), so we can safely remove the NULL check.
> > - Simplify the commit message.
> > - v1: https://lore.kernel.org/all/20260723131242.1537633-1-ruanjinjie@huawei.com/#t
> > 
> > Jinjie Ruan (14):
> >   kexec: Fix CMA segment address translation with non-zero text_offset
> >   kexec: Record allocated CMA pages to fix release size mismatch
> >   kexec: Extract kexec_free_segment_cma() from kimage_free_cma()
> >   arm64: kexec_file: Fix CMA page leaks in segment placement retry loops
> >   arm64: kexec_file: Fix elf_headers memory leak in retry loop
> >   LoongArch: kexec_file: Fix CMA page leaks in segment placement retry
> >     loops
> >   LoongArch: kexec_file: Fix elf_headers memory leak in retry loop
> >   LoongArch: kexec_file: Fix a modified_cmdline leak
> >   x86/crash: Fix massive out-of-bounds write on 32-bit Highmem
> >   crash: Extract crash_get_memory_ranges() helper
> >   crash: Factor out crash_find_elfcorehdr() helper
> >   crash: Normalize the kexec_load elfcorehdr at load time
> >   driver core: Add device_hotplug_lock_assert_held() helper
> >   crash: Fix TOCTOU race in crash memory range collection
> > 
> >  arch/arm64/kernel/kexec_image.c            |   1 +
> >  arch/arm64/kernel/machine_kexec_file.c     |   9 +-
> >  arch/loongarch/kernel/kexec_efi.c          |   1 +
> >  arch/loongarch/kernel/machine_kexec.c      |   2 +
> >  arch/loongarch/kernel/machine_kexec_file.c |  10 +-
> >  arch/powerpc/kexec/crash.c                 |   1 +
> >  arch/x86/kernel/crash.c                    |  40 +++++---
> >  drivers/base/core.c                        |   5 +
> >  include/linux/crash_core.h                 |   2 +
> >  include/linux/device.h                     |   1 +
> >  include/linux/kexec.h                      |   4 +-
> >  kernel/crash_core.c                        | 114 +++++++++++++++++----
> >  kernel/kexec.c                             |   4 +
> >  kernel/kexec_core.c                        |  43 +++++---
> >  kernel/kexec_file.c                        |  13 ++-
> >  15 files changed, 192 insertions(+), 58 deletions(-)
> > 
> 
> -- 
> Best regards,
> Jinjie
>