The retry loop drops nr_segments, leaking the CMA pages of the failed segments. Release them first, and disable CMA for the retry: it ignores buf_min and would hand out the same region forever.
Cc: Catalin Marinas <[email protected]> Cc: Will Deacon <[email protected]> Cc: Breno Leitao <[email protected]> Cc: Pratyush Yadav <[email protected]> Cc: Andrew Morton <[email protected]> Cc: Yeoreum Yun <[email protected]> Cc: Baoquan He <[email protected]> Cc: [email protected] Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation") Signed-off-by: Jinjie Ruan <[email protected]> --- arch/arm64/kernel/kexec_image.c | 8 ++++++++ arch/arm64/kernel/machine_kexec_file.c | 5 ++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c index 74d24c8aa2fa..6ed1991e3142 100644 --- a/arch/arm64/kernel/kexec_image.c +++ b/arch/arm64/kernel/kexec_image.c @@ -111,6 +111,14 @@ static void *image_load(struct kimage *image, * We couldn't find space for the other segments; erase the * kernel segment and try the next available hole. */ + /* + * kexec_alloc_contig() ignores buf_min, so disable CMA to + * let the retry make progress. + */ + if (image->segment_cma[kernel_segment_number]) + image->no_cma = true; + + kexec_free_segment_cma(image, kernel_segment_number); image->nr_segments -= 1; kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz; kbuf.mem = KEXEC_BUF_MEM_UNKNOWN; diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c index 854d872dfd0f..e48f29167b38 100644 --- a/arch/arm64/kernel/machine_kexec_file.c +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -179,7 +179,10 @@ int load_other_segments(struct kimage *image, return 0; out_err: - image->nr_segments = orig_segments; + while (image->nr_segments > orig_segments) { + kexec_free_segment_cma(image, image->nr_segments - 1); + image->nr_segments--; + } kvfree(dtb); return ret; } -- 2.34.1
