The file-based kexec system call places segments with kexec_add_buffer(),
which takes them from CMA when kexec_alloc_contig() succeeds, to avoid
copying the payload at kexec time.
When load_other_segments() cannot place the initrd, the segments of the
attempt are dropped but their CMA pages are leaked. Release them with
kexec_rollback_segments() in the retry loop and in the error path of
load_other_segments().
The loop makes progress by advancing buf_min past a segment placed by the
walk. kexec_alloc_contig() ignores buf_min, so once the pages of a CMA
segment are released, the next attempt can get the same region again and
the retry makes no progress. Disable CMA for the retry.
A CMA segment can be anywhere in RAM, so moving buf_min to its end can
raise the walk's lower bound close to the top of memory and leave the
retry with too little space for the initrd, failing with -EADDRNOTAVAIL.
Only advance buf_min for segments found by the walk.
Tested with a non-crash kexec_file_load() on QEMU virt, 2 GiB RAM and
cma=64M@0xe8000000, which leaves only 64 MiB above the CMA area.
Before the fix:
The retry leaks the CMA pages and kexec_file_load() returns
-EADDRNOTAVAIL even though RAM below CMA is free.
After the fix:
The kernel and initrd are placed below CMA and the second
kernel boots.
Cc: Huacai Chen <[email protected]>
Cc: WANG Xuerui <[email protected]>
Cc: Youling Tang <[email protected]>
Cc: Mike Rapoport (Microsoft) <[email protected]>
Cc: Sourabh Jain <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: [email protected]
Link:
https://sashiko.dev/#/patchset/20260729031235.2840255-1-ruanjinjie%40huawei.com
Fixes: 55d990f0084c ("LoongArch: Add EFI binary support for kexec_file")
Signed-off-by: Jinjie Ruan <[email protected]>
---
arch/loongarch/kernel/kexec_efi.c | 12 ++++++++----
arch/loongarch/kernel/machine_kexec_file.c | 2 +-
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/arch/loongarch/kernel/kexec_efi.c
b/arch/loongarch/kernel/kexec_efi.c
index 4824c47907ac..1fbd0ee1deb6 100644
--- a/arch/loongarch/kernel/kexec_efi.c
+++ b/arch/loongarch/kernel/kexec_efi.c
@@ -82,11 +82,15 @@ static void *efi_kexec_load(struct kimage *image,
break;
/*
- * We couldn't find space for the other segments; erase the
- * kernel segment and try the next available hole.
+ * kexec_alloc_contig() ignores buf_min and always returns
+ * CMA memory, so disable it and keep buf_min.
*/
- image->nr_segments -= 1;
- kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz;
+ if (image->segment_cma[kernel_segment_number])
+ image->no_cma = true;
+ else
+ kbuf.buf_min = kernel_segment->mem +
kernel_segment->memsz;
+
+ kexec_rollback_segments(image, kernel_segment_number);
kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
}
diff --git a/arch/loongarch/kernel/machine_kexec_file.c
b/arch/loongarch/kernel/machine_kexec_file.c
index 5a3d5026303e..0341dfd04b1f 100644
--- a/arch/loongarch/kernel/machine_kexec_file.c
+++ b/arch/loongarch/kernel/machine_kexec_file.c
@@ -191,7 +191,7 @@ int load_other_segments(struct kimage *image,
return 0;
out_err:
- image->nr_segments = orig_segments;
+ kexec_rollback_segments(image, orig_segments);
kfree(modified_cmdline);
return ret;
}
--
2.34.1
