Patch "kexec: fix a memory leak in crash_shrink_memory()" has been added to the 5.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    kexec: fix a memory leak in crash_shrink_memory()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kexec-fix-a-memory-leak-in-crash_shrink_memory.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 38f86974676b88696f3161d2486f2bdf5643603f
Author: Zhen Lei <thunder.leizhen@xxxxxxxxxx>
Date:   Sat May 27 20:34:34 2023 +0800

    kexec: fix a memory leak in crash_shrink_memory()
    
    [ Upstream commit 1cba6c4309f03de570202c46f03df3f73a0d4c82 ]
    
    Patch series "kexec: enable kexec_crash_size to support two crash kernel
    regions".
    
    When crashkernel=X fails to reserve region under 4G, it will fall back to
    reserve region above 4G and a region of the default size will also be
    reserved under 4G.  Unfortunately, /sys/kernel/kexec_crash_size only
    supports one crash kernel region now, the user cannot sense the low memory
    reserved by reading /sys/kernel/kexec_crash_size.  Also, low memory cannot
    be freed by writing this file.
    
    For example:
    resource_size(crashk_res) = 512M
    resource_size(crashk_low_res) = 256M
    
    The result of 'cat /sys/kernel/kexec_crash_size' is 512M, but it should be
    768M.  When we execute 'echo 0 > /sys/kernel/kexec_crash_size', the size
    of crashk_res becomes 0 and resource_size(crashk_low_res) is still 256 MB,
    which is incorrect.
    
    Since crashk_res manages the memory with high address and crashk_low_res
    manages the memory with low address, crashk_low_res is shrunken only when
    all crashk_res is shrunken.  And because when there is only one crash
    kernel region, crashk_res is always used.  Therefore, if all crashk_res is
    shrunken and crashk_low_res still exists, swap them.
    
    This patch (of 6):
    
    If the value of parameter 'new_size' is in the semi-open and semi-closed
    interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the
    calculation result of ram_res is:
    
            ram_res->start = crashk_res.end + 1
            ram_res->end   = crashk_res.end
    
    The operation of insert_resource() fails, and ram_res is not added to
    iomem_resource.  As a result, the memory of the control block ram_res is
    leaked.
    
    In fact, on all architectures, the start address and size of crashk_res
    are already aligned by KEXEC_CRASH_MEM_ALIGN.  Therefore, we do not need
    to round up crashk_res.start again.  Instead, we should round up
    'new_size' in advance.
    
    Link: https://lkml.kernel.org/r/20230527123439.772-1-thunder.leizhen@xxxxxxxxxx
    Link: https://lkml.kernel.org/r/20230527123439.772-2-thunder.leizhen@xxxxxxxxxx
    Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()")
    Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size")
    Signed-off-by: Zhen Lei <thunder.leizhen@xxxxxxxxxx>
    Acked-by: Baoquan He <bhe@xxxxxxxxxx>
    Cc: Cong Wang <amwang@xxxxxxxxxx>
    Cc: Eric W. Biederman <ebiederm@xxxxxxxxxxxx>
    Cc: Michael Holzheu <holzheu@xxxxxxxxxxxxxxxxxx>
    Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index 7a8104d489971..3a37fc62dc95f 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -1029,6 +1029,7 @@ int crash_shrink_memory(unsigned long new_size)
 	start = crashk_res.start;
 	end = crashk_res.end;
 	old_size = (end == 0) ? 0 : end - start + 1;
+	new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN);
 	if (new_size >= old_size) {
 		ret = (new_size == old_size) ? 0 : -EINVAL;
 		goto unlock;
@@ -1040,9 +1041,7 @@ int crash_shrink_memory(unsigned long new_size)
 		goto unlock;
 	}
 
-	start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
-	end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
-
+	end = start + new_size;
 	crash_free_reserved_phys_range(end, crashk_res.end);
 
 	if ((start == end) && (crashk_res.parent != NULL))



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux