Re: [PATCH v4 05/12] LoongArch: kexec_file: Fix CMA page leaks in segment placement retry loops
From: Huacai Chen <chenhuacai@kernel.org>
Date: 2026-09-07 14:05:48
Also in:
kexec, linux-fsdevel, linux-mm, lkml, loongarch
Hi, Jinjie, On Mon, Sep 7, 2026 at 8:53 PM Jinjie Ruan [off-list ref] wrote:
During kexec image placement retry loops, any midway failure causes the loader to truncate `image->nr_segments` back to its initial state to purge the failed segments. However, this truncation introduces a memory leak. The CMA pages allocated via kexec_add_buffer() during the failed attempt are tracked in the `image->segment_cma` array. Because the subsequent cleanup paths only iterate up to the truncated `nr_segments` boundary, these allocated CMA pages outside the new boundary are permanently leaked. Fix this by explicitly releasing the associated CMA buffers in the failure paths before `image->nr_segments` is reduced.
I'm not sure but does the elf version have similar problems as the efi version? Huacai
quoted hunk ↗ jump to hunk
Cc: Huacai Chen <chenhuacai@kernel.org> Cc: WANG Xuerui <kernel@xen0n.name> Cc: Youling Tang <redacted> Cc: "Mike Rapoport (Microsoft)" <rppt@kernel.org> Cc: Sourabh Jain <redacted> Cc: Kees Cook <kees@kernel.org> Cc: stable@vger.kernel.org Link: https://sashiko.dev/#/patchset/20260729031235.2840255-1-ruanjinjie%40huawei.com Fixes: 55d990f0084c ("LoongArch: Add EFI binary support for kexec_file") Signed-off-by: Jinjie Ruan <redacted> --- arch/loongarch/kernel/kexec_efi.c | 1 + arch/loongarch/kernel/machine_kexec_file.c | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-)diff --git a/arch/loongarch/kernel/kexec_efi.c b/arch/loongarch/kernel/kexec_efi.c index 5ee78ebb1546..15fd797ff3de 100644 --- a/arch/loongarch/kernel/kexec_efi.c +++ b/arch/loongarch/kernel/kexec_efi.c@@ -86,6 +86,7 @@ static void *efi_kexec_load(struct kimage *image, * We couldn't find space for the other segments; erase the * kernel segment and try the next available hole. */ + kexec_free_segment_cma(image, kernel_segment_number); image->nr_segments -= 1; kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz; kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;diff --git a/arch/loongarch/kernel/machine_kexec_file.c b/arch/loongarch/kernel/machine_kexec_file.c index 5412aa9f3568..62a5be102065 100644 --- a/arch/loongarch/kernel/machine_kexec_file.c +++ b/arch/loongarch/kernel/machine_kexec_file.c@@ -217,7 +217,11 @@ int load_other_segments(struct kimage *image, return 0; out_err: - image->nr_segments = orig_segments; + while (image->nr_segments > orig_segments) { + kexec_free_segment_cma(image, image->nr_segments - 1); + image->nr_segments--; + } + kfree(modified_cmdline); return ret; } --2.34.1