Re: [PATCH v5 3/3] arm64,ppc64le/kdump: pass dm-crypt keys to kdump kernel

[Andrew Morton]

On Thu, 2 Apr 2026 16:24:14 +0530 Sourabh Jain <sourabhjain@xxxxxxxxxxxxx> wrote:

> But while reading crash_load_dm_crypt_keys() I noticed a possibility of a
> double free at the address pointed by `keys_header`:
> 
> In crash_load_dm_crypt_keys()/crash_dump_dm_crypt.c
>      snip...
> 
>      kbuf.buffer = keys_header;
> 
>      snip....
> 
>      r = kexec_add_buffer(&kbuf);
>      if (r) {
>          pr_err("Failed to call kexec_add_buffer, ret=%d\n", r);
>          kvfree((void *)kbuf.buffer);                           <--- 
> First Free
>          return r;
>      }
> 
> Since `keys_header` is not reset, the next call to build_keys_header()
> will cause a double free at `keys_header`.
> 
> static int build_keys_header(void)
> {
> 
>      snip...
> 
>      if (keys_header != NULL)
>          kvfree(keys_header);
> 
>      snip...
> }
> 
> What do you think?

It looks that way to me.