Sashiko AI code review pointed out there is a TOCTOU (Time-of-Check to Time-of-Use) race condition in prepare_elf_headers() between the initial pass that counts System RAM ranges and the second pass that populates them. If a memory hotplug event occurs between these two steps, the number of memory regions may increase, causing an out-of-bounds write to the cmem->ranges[] array.
Directly introducing get_online_mems() inside prepare_elf_headers() would trigger an immediate recursive read-after-write deadlock when invoked by the runtime hotplug notification path (which already holds the hotplug write lock). To eliminate the TOCTOU window safely without deadlock risks, move the get_online_mems() read lock to the top-level architecture image loaders. Since these top-level loaders are strictly executed on the initial system call path and are never re-entered by the runtime hotplug notifier, this approach physically isolates the locking contexts. The system memory ranges are forced to be statically frozen during the entire layout generation, eradicating the buffer overflow vulnerability. Cc: Youling Tang <[email protected]> Cc: Huacai Chen <[email protected]> Cc: WANG Xuerui <[email protected]> Cc: [email protected] Fixes: 1bcca8620a91 ("LoongArch: Add crash dump support for kexec_file") Signed-off-by: Jinjie Ruan <[email protected]> --- arch/loongarch/kernel/machine_kexec_file.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/arch/loongarch/kernel/machine_kexec_file.c b/arch/loongarch/kernel/machine_kexec_file.c index 5584b798ba46..2a1a6124f043 100644 --- a/arch/loongarch/kernel/machine_kexec_file.c +++ b/arch/loongarch/kernel/machine_kexec_file.c @@ -14,6 +14,7 @@ #include <linux/kernel.h> #include <linux/kexec.h> #include <linux/memblock.h> +#include <linux/memory_hotplug.h> #include <linux/slab.h> #include <linux/string.h> #include <linux/types.h> @@ -75,6 +76,11 @@ static int prepare_elf_headers(void **addr, unsigned long *sz) cmem->max_nr_ranges = nr_ranges; cmem->nr_ranges = 0; for_each_mem_range(i, &start, &end) { + if (WARN_ON_ONCE(cmem->nr_ranges >= cmem->max_nr_ranges)) { + ret = -EAGAIN; + goto out; + } + cmem->ranges[cmem->nr_ranges].start = start; cmem->ranges[cmem->nr_ranges].end = end - 1; cmem->nr_ranges++; @@ -163,12 +169,15 @@ int load_other_segments(struct kimage *image, void *headers; unsigned long headers_sz; + get_online_mems(); ret = prepare_elf_headers(&headers, &headers_sz); if (ret < 0) { + put_online_mems(); pr_err("Preparing elf core header failed\n"); goto out_err; } + put_online_mems(); kbuf.buffer = headers; kbuf.bufsz = headers_sz; kbuf.mem = KEXEC_BUF_MEM_UNKNOWN; -- 2.34.1
