在 2026/9/21 17:04, Jinjie Ruan 写道:
> As Baoquan and Catalin suggested, this patch set fixes
> several pre-existing code issues found by Sashiko AI [1][2][3].
>
> The major improvements and fixes included in this series are:
> - Fix several memory leaks for arm64, and similar issues on LoongArch.
> - Fix out-of-bounds write on 32-bit Highmem for x86.
> - Fix TOCTOU race in crash memory range collection.
Hi all,
Gentle ping.
Could anyone take a look or let me know if there's anything
else needed? I can rebase/resend if required.
>
> This patch set is rebased on v7.3-rc3. Compared to the previous version,
> split out arm64 crash hotplug patches as Breno suggested, which are based
> on these bugfix patches and will be resubmitted after this patch series
> is merged.
>
> Slightly tested on x86_64 and arm64 qemu with:
> - kexec_load (--kexec-syscall --hotplug)
> - kexec_load (--kexec-file-syscall)
>
> All boot successfully into the second kernel.
>
> [1]:
> https://lore.kernel.org/all/[email protected]/
> [2]:
> https://sashiko.dev/#/patchset/20260729031235.2840255-1-ruanjinjie%40huawei.com
> [3]:
> https://sashiko.dev/#/patchset/20260907125404.922123-1-ruanjinjie%40huawei.com
>
> Changes in v6:
> - Split out arm64 crash hotplug patches as Breno suggested.
> - Remove unused elfcorehdr_updated [4].
> - Make the patch split more clear.
> - Link to v5:
> https://lore.kernel.org/all/[email protected]/
>
> [4]:
> https://sashiko.dev/#/patchset/20260907125404.922123-1-ruanjinjie%40huawei.com
>
> Changs in v5:
> - Rebased on v7.3-rc3.
> - Fix several pre-existing code issues reported by Sashiko AI review. [3]
> - Add an extra slot for memory hot-unplug.
> - Add device_hotplug_lock_assert_held() helper.
> - Rework to let the hotplug paths to skip CPU events entirely, which avoid
> the TOCTOU race of memory hotplug events and internal CPU offline path
> without holding device_hotplug_lock.
> - Link to v4:
> https://lore.kernel.org/all/[email protected]/
>
> Changes in v4:
> - Rebased on v7.3-rc1.
> - Update the kexec_core code as Mike suggested.
> - Update the LoongArch subject as Huacai suggested.
> - Drop crash_dump_dm_crypt patch which will be fixed by Coiby in [4] as
> Sourabh suggested.
> - Drop x86 related patches because of branch conflict, which will
> be done later.
> - Drop the incorrect CRASH_MAX_MEMORY_RANGES patch.
> - Handle elfcorehdr_index in arm64 arch code.
> - Link to v3:
> https://lore.kernel.org/all/[email protected]/
>
> [4] https://lore.kernel.org/all/[email protected]/
>
> Changes in v3:
> - Handle "KEXEC_CRASH_HP_REMOVE_MEMORY" action.
> - Fix several pre-existing code issues reported by Sashiko AI review [3].
> - Introduce crash_extra_elfcorehdr_size() and elf64_phdr_size() helper.
> - Rework related crash and arch code.
> - Add test method.
> - v2:
> https://lore.kernel.org/all/[email protected]/
>
> Changes in v2:
> - Split out Powerpc bugfix patch as Mike suggested.
> - Use phys_to_virt() instead of __va() in update_crash_elfcorehdr().
> - Convert pnum_hdr_sz() to a function.
> - Only assign elfcorehdr_index after kexec_add_buffer succeeds, considering
> crash_handle_hotplug_event() already performs validity check on
> elfcorehdr_index:
> - We can safely remove the check for CPU hotplug
> in arch_crash_handle_hotplug_event().
> - The elfcorehdr_index's segment mem will be valid in
> update_crash_elfcorehdr(), so we can safely remove the NULL check.
> - Simplify the commit message.
> - v1:
> https://lore.kernel.org/all/[email protected]/#t
>
> Jinjie Ruan (14):
> kexec: Fix CMA segment address translation with non-zero text_offset
> kexec: Record allocated CMA pages to fix release size mismatch
> kexec: Extract kexec_free_segment_cma() from kimage_free_cma()
> arm64: kexec_file: Fix CMA page leaks in segment placement retry loops
> arm64: kexec_file: Fix elf_headers memory leak in retry loop
> LoongArch: kexec_file: Fix CMA page leaks in segment placement retry
> loops
> LoongArch: kexec_file: Fix elf_headers memory leak in retry loop
> LoongArch: kexec_file: Fix a modified_cmdline leak
> x86/crash: Fix massive out-of-bounds write on 32-bit Highmem
> crash: Extract crash_get_memory_ranges() helper
> crash: Factor out crash_find_elfcorehdr() helper
> crash: Normalize the kexec_load elfcorehdr at load time
> driver core: Add device_hotplug_lock_assert_held() helper
> crash: Fix TOCTOU race in crash memory range collection
>
> arch/arm64/kernel/kexec_image.c | 1 +
> arch/arm64/kernel/machine_kexec_file.c | 9 +-
> arch/loongarch/kernel/kexec_efi.c | 1 +
> arch/loongarch/kernel/machine_kexec.c | 2 +
> arch/loongarch/kernel/machine_kexec_file.c | 10 +-
> arch/powerpc/kexec/crash.c | 1 +
> arch/x86/kernel/crash.c | 40 +++++---
> drivers/base/core.c | 5 +
> include/linux/crash_core.h | 2 +
> include/linux/device.h | 1 +
> include/linux/kexec.h | 4 +-
> kernel/crash_core.c | 114 +++++++++++++++++----
> kernel/kexec.c | 4 +
> kernel/kexec_core.c | 43 +++++---
> kernel/kexec_file.c | 13 ++-
> 15 files changed, 192 insertions(+), 58 deletions(-)
>
--
Best regards,
Jinjie
