From nobody Mon Feb 9 08:12:23 2026 Received: from mail-yw1-f196.google.com (mail-yw1-f196.google.com [209.85.128.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 405AE4A07 for ; Fri, 19 Dec 2025 03:08:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766113741; cv=none; b=YM4oarweqsQ1nFB+ayg+p22ffVJTD/9m/GxWPTdcBZuJC9TzFNMl3yrf9DJTfktMzn/BDWJALO0ec5v+Qe61RaS3IINwvr931FZH1Q29mXYFEXEdxslDwGcvZK5B2NafMfBtK6G+GCsxmRmM87Fasms5zT3yzYnbSZeSIamOK5I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766113741; c=relaxed/simple; bh=O3KZB3I1FT2Mu+Gm+lEeycSse5ROKRKwlefLaUl/KKg=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=Uia7eDMrMHGXUtKb5M070CkAnV/eAgEI7BmJsyUhLbAeO5Ww3y6Ncr3VcsWnthvXW+bOKnCo8jy8XJc4jrwaRfTN5SGRIJwe8PFPWbSvEtmYMRw/3LPZuNrYKQPR06QlvBcNLw8aTD8nzO5Q/f/EyX7Gt6KoBKeJwBCusrKZyxI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=soleen.com; spf=pass smtp.mailfrom=soleen.com; dkim=pass (2048-bit key) header.d=soleen.com header.i=@soleen.com header.b=We2ZUiIv; arc=none smtp.client-ip=209.85.128.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=soleen.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=soleen.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=soleen.com header.i=@soleen.com header.b="We2ZUiIv" Received: by mail-yw1-f196.google.com with SMTP id 00721157ae682-787da30c50fso11967347b3.3 for ; Thu, 18 Dec 2025 19:08:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=soleen.com; s=google; t=1766113738; x=1766718538; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=r2/OhVQU+QVH8G/cODFOhwoAozt9Fs2Kb3PN40QPAds=; b=We2ZUiIvPAF3V3qjWvrcV0YIUVsikQzlrI8U/wxHhIv/1DIkspE28EvDMy4gvKYMJR UJZHfP99GUBzWpBd3Rj8fTkbLRLnKmPHOA4kwUi1z929vU9UZWJmj8zgCgAHMrAdGmUV KiszC8hlq1jisYxeyYeQamuWwAlQJZ7tw7PyCg9xXxK+pRoZyCyUDC68bJsfpq6qANPq 9R3M+dTHDzwEHXaFlxNga+gouz/3md/gSmFnM3mE4NCPIwO+XJsGaFUk+3ppXU+a6+M/ YS3IDQS05K/WQJ+Gl23IDuaTUU+9YeU45y3p3eLXVFKYZpVi9OTOtBiRn3NyW0jWQ6pZ f9Zw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766113738; x=1766718538; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=r2/OhVQU+QVH8G/cODFOhwoAozt9Fs2Kb3PN40QPAds=; b=AHM8AeJ8YUF6kDphqAGlhXBteltG1E75Ng0XaB08AaCX5EsFL6b1JLghFlPXDsr7yi JYYYW95nVcYXl7qCkn8r81PcSOPYZQvT7fefGAKzjb1NoZTedDtC6hJUotoE+G97c2MT kGpVVGPkbJt1qLdhwfZzI7nIXMeYCcBVa0ihkoCUW2lzPZUBTYwstvJPGjBPekoWyQAe Jts8aSxU/SGwp+ELdyjt6LCOwL4W4lnNXY9jr7s158fkNB4BVzU/oTSQ9x57mpG4C9pA UUPZATKeQz5QA4N8b+vhuEAfbENyB6CkaFgqFSc7cc8o7PY4bojQ38WTGZ7pzFR+BU3N GxGg== X-Forwarded-Encrypted: i=1; AJvYcCWoAjazQ6jRuhvy0BloNwC2T3UnvL9EBvARn7ZjF9RZSwvEWeUBL3UFV32YN3T6gPreRiJHKEmVXZN+zjI=@vger.kernel.org X-Gm-Message-State: AOJu0Yyy/bE1/yxq0T69Hm4IdRyAzGZbe5flDx1Cy/1sOhHQUgRafC4E 8A4SpzXDRC2zq3WNhDR/qaHz6/Ip/tzS8SIcmhr+PnOekCgfpRuOtv/VmNiYOdiOCvw= X-Gm-Gg: AY/fxX5fFH87cl0A5v1OIMlyyIt6kNMD3x+lCiUIane05rOZ2ziC4/DlbpBVOK3dN+Q gzbC8FwFocRw3WVMfTgjr3VbyQrZNT+U4svj9+HBSoAStapZdnptez32rC2p8qV1vZkpsgVZtsL Vr7sWZNBuGftiI5dOxxQ/Da+N8z0XeAh7cTEHFejWLQ+3O1dilFcr8qwQYRrCqpaOPiVprQMzeo MWBeMsBtReCnM1S3sn10M4+zMExPw1mJuqMg8aMbtjXw4cvnVAQmy+FKv0ZwALI8TYoaLX5c3cv TcBzNE1zLoIHdMSpICeX0vd5G7atLSFKHpR55kC2W6yK7/W7LoySn6tkNp9jj406dgdHuOIgVG1 4AFucLTYbiu5TaeZBQuS2VrGQzJwW46OZ3KxUc0IZz50tENKLbdQk2UyLbstbj+A33xy/x45zMl JpceA3dTZeAy3lAi5cBRnP0KWZ/oxAUCineHUhlN8Gp1WSMVQFi/reqX+fetQN/IQnJLEx/6AGA HBtPEHEX1zLEgs6599lL0wV8sYy0+jy97f2zg== X-Google-Smtp-Source: AGHT+IH0SFFGcLuZ3Rz+C1B/s4/iGdSlEwbIjM/JS7E1t+K9R5SfPZNhnq31cCe+ZYL8cHIylt29xg== X-Received: by 2002:a05:690c:c4f6:b0:786:5afa:375c with SMTP id 00721157ae682-78fb40d9808mr27748627b3.67.1766113738125; Thu, 18 Dec 2025 19:08:58 -0800 (PST) Received: from soleen.c.googlers.com.com (182.221.85.34.bc.googleusercontent.com. [34.85.221.182]) by smtp.gmail.com with ESMTPSA id 00721157ae682-78fb43790dcsm5069027b3.11.2025.12.18.19.08.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Dec 2025 19:08:57 -0800 (PST) From: Pasha Tatashin To: akpm@linux-foundation.org, pasha.tatashin@soleen.com, rppt@kernel.org, graf@amazon.com, linux-kernel@vger.kernel.org, kexec@lists.infradead.org, linux-mm@kvack.org, pratyush@kernel.org, ricardo.neri-calderon@linux.intel.com Subject: [PATCH v2] kho: validate preserved memory map during population Date: Thu, 18 Dec 2025 22:08:54 -0500 Message-ID: <20251219030854.3527871-1-pasha.tatashin@soleen.com> X-Mailer: git-send-email 2.52.0.322.g1dd061c0dc-goog Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If the previous kernel enabled KHO but did not call kho_finalize() (e.g., CONFIG_LIVEUPDATE=3Dn or userspace skipped the finalization step), the 'preserved-memory-map' property in the FDT remains empty/zero. Previously, kho_populate() would succeed regardless of the memory map's state, reserving the incoming scratch regions in memblock. However, kho_memory_init() would later fail to deserialize the empty map. By that time, the scratch regions were already registered, leading to partial initialization and subsequent list corruption (double-free) during kho_init(). Move the validation of the preserved memory map earlier into kho_populate(). If the memory map is empty/NULL: 1. Abort kho_populate() immediately with -ENOENT. 2. Do not register or reserve the incoming scratch memory, allowing the new kernel to reclaim those pages as standard free memory. 3. Leave the global 'kho_in' state uninitialized. Consequently, kho_memory_init() sees no active KHO context (kho_in.mem_chunks_phys is 0) and falls back to kho_reserve_scratch(), allocating fresh scratch memory as if it were a standard cold boot. Fixes: de51999e687c ("kho: allow memory preservation state updates after fi= nalization") Reported-by: Ricardo Closes: https://lore.kernel.org/all/20251218215613.GA17304@ranerica-svr.sc.= intel.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) --- Changes v2: - Removed phys_to_virt() from kho_populate(). kernel/liveupdate/kexec_handover.c | 39 ++++++++++++++++-------------- 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_h= andover.c index 9dc51fab604f..6ba554208c81 100644 --- a/kernel/liveupdate/kexec_handover.c +++ b/kernel/liveupdate/kexec_handover.c @@ -460,27 +460,23 @@ static void __init deserialize_bitmap(unsigned int or= der, } } =20 -/* Return true if memory was deserizlied */ -static bool __init kho_mem_deserialize(const void *fdt) +/* Returns head of preserved physical memory chunks pointer from FDT */ +static phys_addr_t __init kho_get_mem_chunks_phys(const void *fdt) { - struct khoser_mem_chunk *chunk; const void *mem_ptr; - u64 mem; int len; =20 mem_ptr =3D fdt_getprop(fdt, 0, PROP_PRESERVED_MEMORY_MAP, &len); if (!mem_ptr || len !=3D sizeof(u64)) { pr_err("failed to get preserved memory bitmaps\n"); - return false; + return 0; } =20 - mem =3D get_unaligned((const u64 *)mem_ptr); - chunk =3D mem ? phys_to_virt(mem) : NULL; - - /* No preserved physical pages were passed, no deserialization */ - if (!chunk) - return false; + return get_unaligned((const u64 *)mem_ptr); +} =20 +static void __init kho_mem_deserialize(struct khoser_mem_chunk *chunk) +{ while (chunk) { unsigned int i; =20 @@ -489,8 +485,6 @@ static bool __init kho_mem_deserialize(const void *fdt) &chunk->bitmaps[i]); chunk =3D KHOSER_LOAD_PTR(chunk->hdr.next); } - - return true; } =20 /* @@ -1253,6 +1247,7 @@ bool kho_finalized(void) struct kho_in { phys_addr_t fdt_phys; phys_addr_t scratch_phys; + phys_addr_t mem_chunks_phys; struct kho_debugfs dbg; }; =20 @@ -1434,12 +1429,10 @@ static void __init kho_release_scratch(void) =20 void __init kho_memory_init(void) { - if (kho_in.scratch_phys) { + if (kho_in.mem_chunks_phys) { kho_scratch =3D phys_to_virt(kho_in.scratch_phys); kho_release_scratch(); - - if (!kho_mem_deserialize(kho_get_fdt())) - kho_in.fdt_phys =3D 0; + kho_mem_deserialize(phys_to_virt(kho_in.mem_chunks_phys)); } else { kho_reserve_scratch(); } @@ -1448,8 +1441,9 @@ void __init kho_memory_init(void) void __init kho_populate(phys_addr_t fdt_phys, u64 fdt_len, phys_addr_t scratch_phys, u64 scratch_len) { - void *fdt =3D NULL; struct kho_scratch *scratch =3D NULL; + phys_addr_t mem_chunks_phys; + void *fdt =3D NULL; int err =3D 0; unsigned int scratch_cnt =3D scratch_len / sizeof(*kho_scratch); =20 @@ -1475,6 +1469,14 @@ void __init kho_populate(phys_addr_t fdt_phys, u64 f= dt_len, goto out; } =20 + mem_chunks_phys =3D kho_get_mem_chunks_phys(fdt); + if (!mem_chunks_phys) { + pr_warn("setup: handover FDT (0x%llx) present but no preserved memory fo= und\n", + fdt_phys); + err =3D -ENOENT; + goto out; + } + scratch =3D early_memremap(scratch_phys, scratch_len); if (!scratch) { pr_warn("setup: failed to memremap scratch (phys=3D0x%llx, len=3D%lld)\n= ", @@ -1515,6 +1517,7 @@ void __init kho_populate(phys_addr_t fdt_phys, u64 fd= t_len, =20 kho_in.fdt_phys =3D fdt_phys; kho_in.scratch_phys =3D scratch_phys; + kho_in.mem_chunks_phys =3D mem_chunks_phys; kho_scratch_cnt =3D scratch_cnt; pr_info("found kexec handover data.\n"); =20 base-commit: ea1013c1539270e372fc99854bc6e4d94eaeff66 --=20 2.52.0.322.g1dd061c0dc-goog