From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793259774; b=Umm2hlE2Vea4dN3a16yPZON4r0HDcIU7ATdcxiVjuBQNZqrm4QuQAU7ZSDg0UAR6Zekj x/P3g8jOxsQM4+IqPntCF8eHd09afK8eypwzmKs0CD7ckiGQ0EpkYNt0XKNOv4ZAglKR7 Rar7k/1f6Kk0kKTGBQIZ4phyO4m1b12ebkmsrrn46e4HtV1Pqt8jeTKoCZ0HwRVWcBSRU fFUmobs26ni42yBqN0BHAh8PiJ/zXzSAuwa0W/kdFIOsbBPSFYBuhxo8KR6NOqdB4Dil2 RUZroV/pDEToP6h8NTi97i7Hs0zuoFfkPLVnjcl0Ep4wr+j+fojytsC+IHLgQe8BLVw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793259774; h=Received:DKIM-Signature:Date:From:To:Cc:Subject:Message-ID: References:MIME-Version:Content-Type:Content-Disposition:In-Reply-To; bh=FnIFycVxPAWcUtQJVVl8WWNhkjZ3nGmUb3DoahAD2uA=; b=Wb5bLUmMrXzLQXqTa1KLrgMR8aPd2qyU6hh/B3L3MytzpcT6yIikk2TRszxonq7o66qy RlLtWbXYJEfus46CwoFb0NEWUA3+rIxMop4FjBfOCCfsDmw2fDIbHjxzoV4+mwnI0ELGD wsp2SZqe6ETuHPEom2+pLHjiOprEuCVDx84ZLUI/rXkrravuYai2lzNYfq4vR4ITJadSr f9ETkYYgb0eZjJThImYDe2qQ/eT4mVjmdbt+EDRR+tkG7gTtCCz6EcvZjQ/so8T7Z783Y GBFW7fnVMhMqEcojjIERWoewoZxEatQqqFYCkZ4/rEzZBjPhG3RVu6bAQAU7cAdHo7A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=kyhGWe6l; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8691606A31C for ; Thu, 29 Oct 2026 07:42:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=kyhGWe6l Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9341E1F01825; Thu, 29 Oct 2026 07:42:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793259773; bh=FnIFycVxPAWcUtQJVVl8WWNhkjZ3nGmUb3DoahAD2uA=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=kyhGWe6lxVRHmY2A8+LGSw1PRADfLdQmrVkp+WhLyFDADBLYh8qf3hGC5GTEK+fSF Jj/v3QEiuO7gjUpaIXVyTATrvvq9I6g4baEtUIVoGDwXpnF+o/TeEZDQiRMFkDcbew ZQdVQCTzLEA+Hww6c13lr+LoMchRaHYwLVxQxOkIoM45XpeSdhHLX65djGGdiUJJ78 mJUA2Zlei2hoGSD4uWSuxwrH9OGr9GLofCzJqHLnu2IBvJKGUNupUdrj23PTU+bd9N JJDt/fdMYbCWxRtaQV1Ol+ZTtK0g8tYLUsxvNcM7JRAyAW1XcCrcG5SkvYBx9Um9dk 0OmuuPIFH28Kw== Date: Thu, 29 Oct 2026 09:42:44 +0200 From: Mike Rapoport To: Radhey Shyam Pandey Cc: akpm@linux-foundation.org, david@kernel.org, ljs@kernel.org, liam@infradead.org, vbabka@kernel.org, surenb@google.com, mhocko@suse.com, baoquan.he@linux.dev, pasha.tatashin@soleen.com, pratyush@kernel.org, graf@amazon.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kexec@lists.infradead.org Subject: Re: [RFC PATCH 2/2] mm/cma: reject CMA areas that overlap the kernel image Message-ID: References: <20261014145731.3431527-1-radhey.shyam.pandey@amd.com> <20261014145731.3431527-3-radhey.shyam.pandey@amd.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20261014145731.3431527-3-radhey.shyam.pandey@amd.com> On Wed, Oct 14, 2026 at 08:27:31PM +0530, Radhey Shyam Pandey wrote: > cma_init_reserved_mem() takes a base address chosen by its caller and > requires that the range already be reserved. That makes an overlap with > the kernel image indistinguishable from the normal case by looking at > memblock alone, yet such an area is fatal: cma_activate_area() hands it > to init_cma_reserved_pageblock(), which unconditionally clears > PageReserved on every page and frees them into MIGRATE_CMA, overriding > the memblock_reserve() of [_text, _end) that the architecture installed. > Those pages satisfy ordinary movable allocations from that point on, so > userspace is handed live kernel text. > > The preceding patch closes the way this is reachable today, where a > kexec'd kernel runs from inside the default CMA area and then declares > the range it is executing from as a shared-dma-pool. On a VEK385 that > reproduced within ~300ms of /sbin/init starting, as a copy-on-write > fault writing to the read-only linear alias of .text: > > Unable to handle kernel write to read-only memory at virtual address ffff00084030c000 > Call trace: > copy_page+0x48/0xc4 (P) > copy_user_highpage+0x14/0x30 > __handle_mm_fault+0x318/0x1340 > > Dynamically placed areas cannot hit this: __cma_declare_contiguous_nid() > either rejects a fixed base that is already reserved, or picks an address > itself and so avoids the kernel image. Only a caller that passes a base > chosen elsewhere can, so check for the overlap explicitly rather than > leave the next such caller to corrupt the kernel silently. > > Note that failing here is not by itself sufficient for a device-tree > pool. fdt_init_reserved_mem_node() responds to an error from a non-nomap > region by calling memblock_phys_free() on the whole range, which drops > the kernel image's own reservation along with it, so the pages are still > released - as plain free memory rather than MIGRATE_CMA. Callers that > keep their reservation on failure, such as powerpc's fadump_cma_init(), > are fully protected. For the device-tree path this is a diagnostic and a > second line of defence behind the preceding patch. > > Assisted-by: Claude:claude-opus-5 > Signed-off-by: Radhey Shyam Pandey > --- > mm/cma.c | 23 +++++++++++++++++++++++ > 1 file changed, 23 insertions(+) > > diff --git a/mm/cma.c b/mm/cma.c > index 1f4d3d48a3bb..32b799a3f5c8 100644 > --- a/mm/cma.c > +++ b/mm/cma.c > @@ -31,6 +31,8 @@ > #include > #include > > +#include > + > #include "internal.h" > #include "cma.h" > #include "mm_init.h" > @@ -68,6 +70,11 @@ bool cma_has_fixed_base(const struct cma *cma) > return test_bit(CMA_FIXED_BASE, &cma->flags); > } > > +static bool cma_overlaps_kernel_image(phys_addr_t base, phys_addr_t size) > +{ > + return base < __pa_symbol(_end) && __pa_symbol(_text) < base + size; > +} We have helpers for that in include/asm-generic/sections.h > + > static unsigned long cma_bitmap_aligned_mask(const struct cma *cma, > unsigned int align_order) > { > @@ -295,6 +302,22 @@ int __init cma_init_reserved_mem(phys_addr_t base, phys_addr_t size, > if (!size || !memblock_is_region_reserved(base, size)) > return -EINVAL; > > + /* > + * The area being already reserved is expected here, so an overlap with > + * the kernel image cannot be told apart from the normal case by looking > + * at memblock alone. Check for it explicitly: activating such an area > + * clears PageReserved on the kernel's own text and data and releases > + * them to the page allocator. > + */ I don't think this comment is useful, the check itself is clear enough. > + if (cma_overlaps_kernel_image(base, size)) { > + phys_addr_t text = __pa_symbol(_text); > + phys_addr_t end = __pa_symbol(_end); > + > + pr_err("area %s (%pa, size %pa) overlaps kernel image [%pa-%pa]\n", > + name ?: "(unnamed)", &base, &size, &text, &end); > + return -EBUSY; > + } > + With removing cma_init_reserved_mem() from API this would move to __cma_declare_contiguous_nid(). > /* > * CMA uses CMA_MIN_ALIGNMENT_BYTES as alignment requirement which > * needs pageblock_order to be initialized. Let's enforce it. > -- > 2.43.0 > -- Sincerely yours, Mike.