在 2026/9/18 18:36, [email protected] 写道:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s)
> to consider:
> - [High] kexec: arch_crash_get_elfcorehdr_size() exports undersized buffer
> when MEMORY_HOTPLUG is disabled
> --
>
> commit fd293f9cfd1a12554d9352f4ad58fc9f85721fa3
> Author: Jinjie Ruan <[email protected]>
> arm64: crash: Add crash hotplug support
>
> This commit introduces kernel mechanisms to update only the elfcorehdr
> on memory hotplug events for arm64. It adds ARCH_SUPPORTS_CRASH_HOTPLUG
> and implements arch-specific functions to handle memory hotplug, avoiding
> full kdump image reloads from userspace.
>
> Link:
> https://lore.kernel.org/all/[email protected]/
>
>> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
>> index b5a51b0ef9440..96de2660b1cbb 100644
>> --- a/arch/arm64/Kconfig
>> +++ b/arch/arm64/Kconfig
>> @@ -1720,6 +1720,9 @@ config ARCH_DEFAULT_CRASH_DUMP
>> config ARCH_HAS_GENERIC_CRASHKERNEL_RESERVATION
>> def_bool CRASH_RESERVE
>>
>> +config ARCH_SUPPORTS_CRASH_HOTPLUG
>> + def_bool y
>> +
>
> [Severity: High]
> Does unconditionally enabling ARCH_SUPPORTS_CRASH_HOTPLUG here expose an
> undersized buffer to userspace when CONFIG_MEMORY_HOTPLUG is disabled?
>
> Since CONFIG_HOTPLUG_CPU natively selects CONFIG_CRASH_HOTPLUG on
> architectures that support it, having this default to 'y' allows
> CRASH_HOTPLUG to be active even without MEMORY_HOTPLUG. This leads to the
> size calculation issue below.
>
> [ ... ]
>> diff --git a/arch/arm64/kernel/crash.c b/arch/arm64/kernel/crash.c
>> new file mode 100644
>> index 0000000000000..08dc9b952498e
>> --- /dev/null
>> +++ b/arch/arm64/kernel/crash.c
> [ ... ]
>> +unsigned int arch_crash_get_elfcorehdr_size(void)
>> +{
>> + unsigned long phdr_cnt;
>> +
>> + /* A program header for possible CPUs, vmcoreinfo and kernel_map */
>> + phdr_cnt = 2 + num_possible_cpus();
>> + if (IS_ENABLED(CONFIG_MEMORY_HOTPLUG))
>> + phdr_cnt += CONFIG_CRASH_MAX_MEMORY_RANGES;
>> +
>
> [Severity: High]
> Is this calculation missing the static memory ranges when
> CONFIG_MEMORY_HOTPLUG is disabled?
>
> If compiled with CONFIG_HOTPLUG_CPU=y (which natively selects
> CONFIG_CRASH_HOTPLUG) and CONFIG_MEMORY_HOTPLUG=n, phdr_cnt is computed as
> exactly 2 + num_possible_cpus(). This does not account for the mandatory
> memblock ranges from arch_get_system_nr_ranges().
Will fix it in v6.
>
> Unlike x86 or powerpc which might survive this due to heavily padded
> CONFIG_NR_CPUS_DEFAULT values, arm64's precise num_possible_cpus() leaves
> zero headroom. As a result, the exported maximum elfcorehdr size is strictly
> smaller than the required size to hold static memory ranges, and any attempt
> to arm kdump (kexec -p) will fail because kexec-tools cannot load the crash
> kernel into the undersized segment.
>
--
Best regards,
Jinjie
