From nobody Mon Feb 9 06:49:37 2026 Received: from mail-yw1-f196.google.com (mail-yw1-f196.google.com [209.85.128.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2BD1A18DB2A for ; Fri, 19 Dec 2025 07:12:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766128336; cv=none; b=Z1qwI7UVjI25shBMlXas4abJ9wHiTWWl9sHCFTCfS4wGO80rHCQ8QzJTnW5CpFdn4qq2D2SDZCAdCgyjJiFLyLcescYpKZAX4PooLveImnBHjsysQMcFuaUNYMCajY4zy1sPdNVWQbq4wLW9ogwVpeQ7N31rVQGJ9wjJFWlrXiU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766128336; c=relaxed/simple; bh=DO3Zkak46u5spoMYDUJTzCnGGw9uuoTNbovpc242rmQ=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=LjaOn2iSRcAjdMdRNLerl3rr6XRNZwADiO4GGcCs4Lgj2wDDgmtyTxxF4UvM306bwZVUNpInTq6BgIeFyefmYmvp7xB4A9EN3TukEiEtMMTz7nb8Q+JNY6KhmGjH+2sS4npCWJbghqoECKrIVQx8eKOhGNG15iz7eb1IRSXinz0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=soleen.com; spf=pass smtp.mailfrom=soleen.com; dkim=pass (2048-bit key) header.d=soleen.com header.i=@soleen.com header.b=RKYyoV7j; arc=none smtp.client-ip=209.85.128.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=soleen.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=soleen.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=soleen.com header.i=@soleen.com header.b="RKYyoV7j" Received: by mail-yw1-f196.google.com with SMTP id 00721157ae682-787d5555274so14809257b3.1 for ; Thu, 18 Dec 2025 23:12:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=soleen.com; s=google; t=1766128334; x=1766733134; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=6QLENq4Vv2SQsAQ4s6mi75aJFbGZLylufA139w0/C0s=; b=RKYyoV7jXMyvo0c+BCMqtHexYzNna4wjlLRsz21sbom/9ha/+s/vGkFkGn/mBYf1Ar bXSZB2d6E0srH4tCFB10QtsUM20p7URuLKemWJrMv2XS7hxqe3Fn8Mp2AmAC0iDmJtzi ETcXcpwCRvqCWkxzqzIUcoDq9ZB3d17jXawRicoqw6ujWDdy2BIs7uKkKN/qXma/K0Qv 07OGcksdkEBdNL6owt/GpCfnj4knTkByeAITRSj3tL2BVQaPMt/CzIGTQiGCG8KeftpA RV6S/k0IBetyRaMpsHFqykddh48P+W4FkX+EUV7GVjGarPBpOOPqlrz+3uXKNWKrEMrB U7uw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766128334; x=1766733134; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=6QLENq4Vv2SQsAQ4s6mi75aJFbGZLylufA139w0/C0s=; b=BhxJfqdOBCoSLaCsnC24o1zNklc6Fvm5PhGSDTByO4ed+BrP/3qW4pTfwK+Gxpd6Be x0qsI+gX/rfxUIeYTDUSDZdl1Tj08PS5eWVHrv7j84Nu4Rhla6WhnAMT+azzWYWRcbOu 7Kr2VThzTAemAS79Eqby8bYVhXyDm3VEvueJEsE2KqIxNs59MWpukSaepYcNh6IP4lQy PduwtcnYZi0/wJym5Cl6X77ebWGhQUZukESbbxcb2j7+UOigG60XVIldRRgn2tO/hfDu kWIvF9J8cWWa8iminTUlKF8ebV1YXeRzXHQup+zpyVuqLrZ/2/U7e1f5kUEiqJp0e2e/ 52Ag== X-Forwarded-Encrypted: i=1; AJvYcCU5OVh49hIPpy/lODyVTdVZJk0bzPvReJw24sFmbc9KC6rTJ4rrXn6BJiZS44hkvZg6FyN+Iun+8kVbWEU=@vger.kernel.org X-Gm-Message-State: AOJu0YwUjWM0yHFiOKrM/5R65ColcwtGsP9ajsWOfAhuWNDDvSH0Alqd xlmNd4/5rJHeZ5mYfgcXEXsmNkNj7MOmQZLD77JweGusnU0W6HU5ZfwFKI/BytHCMbM= X-Gm-Gg: AY/fxX7c5qdXnlVeijmxeRCwe/iEGcMyh8xwh3Ix45jiwtdKkjdvTc6bX96rT6mlR2V xWi0zv9VfqsKhvOitswe0+ZWqUAmEG3g+PoEWQiQHKRko3HG6csZZIh5oVVb7xK5gq/LjLHtKYq VCBWl80AssaYiwXHdMYEehdR/LcbQBWsJoQQl5FSA4LEGmx4nf1CpV7gesJbXM4LaG4g4jVbYk1 x0fcaQXGxZ9QoetT3M6eMjGI27sxCpe5khKV+KdSrIBKdeQznn4ldxIB40qWqe5BViftuJeIlWP Uyh9x/AP+lmBbuI47BZoEpxqI+dgO8aAH0A/LzYQmStVMyuLlpLj7KdWtoh7UmXZvvUuWdwMiDh 4wW/ZEH8WfvAZIBM25BN3RBdqxyMgdCAV2lJ50zj1sL5mY4fOESVMLWNbnb5wcxFCCdHG1GQIz4 MiAm6qKrqKSqW6MouVHJKHqYlMSrI4t9a7nuEv8J7KKOU95fv2qw9Vj5brzsoMnLLfUVLTNQEtE HIKXMeze/sUB6eryj/X4GzcGoxGspdccjyBkg== X-Google-Smtp-Source: AGHT+IEWVVc2D1cqR3AcZS0yhRsNlUTKLbAvt0ocD1LffHnt0W3gu7vYKX6GCKHep/ypCYEXliKiAQ== X-Received: by 2002:a05:690c:368f:b0:787:febb:7f82 with SMTP id 00721157ae682-78fb3ecce81mr19078597b3.8.1766128334090; Thu, 18 Dec 2025 23:12:14 -0800 (PST) Received: from soleen.c.googlers.com.com (182.221.85.34.bc.googleusercontent.com. [34.85.221.182]) by smtp.gmail.com with ESMTPSA id 00721157ae682-78fb44f0d57sm6743917b3.31.2025.12.18.23.12.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Dec 2025 23:12:13 -0800 (PST) From: Pasha Tatashin To: akpm@linux-foundation.org, pasha.tatashin@soleen.com, rppt@kernel.org, graf@amazon.com, linux-kernel@vger.kernel.org, kexec@lists.infradead.org, linux-mm@kvack.org, pratyush@kernel.org, ricardo.neri-calderon@linux.intel.com Subject: [PATCH v3] kho: validate preserved memory map during population Date: Fri, 19 Dec 2025 02:12:09 -0500 Message-ID: <20251219071209.3696755-1-pasha.tatashin@soleen.com> X-Mailer: git-send-email 2.52.0.322.g1dd061c0dc-goog Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If the previous kernel enabled KHO but did not call kho_finalize() (e.g., CONFIG_LIVEUPDATE=3Dn or userspace skipped the finalization step), the 'preserved-memory-map' property in the FDT remains empty/zero. Previously, kho_populate() would succeed regardless of the memory map's state, reserving the incoming scratch regions in memblock. However, kho_memory_init() would later fail to deserialize the empty map. By that time, the scratch regions were already registered, leading to partial initialization and subsequent list corruption (double-free) during kho_init(). Move the validation of the preserved memory map earlier into kho_populate(). If the memory map is empty/NULL: 1. Abort kho_populate() immediately with -ENOENT. 2. Do not register or reserve the incoming scratch memory, allowing the new kernel to reclaim those pages as standard free memory. 3. Leave the global 'kho_in' state uninitialized. Consequently, kho_memory_init() sees no active KHO context (kho_in.mem_chunks_phys is 0) and falls back to kho_reserve_scratch(), allocating fresh scratch memory as if it were a standard cold boot. Fixes: de51999e687c ("kho: allow memory preservation state updates after fi= nalization") Reported-by: Ricardo Neri Closes: https://lore.kernel.org/all/20251218215613.GA17304@ranerica-svr.sc.= intel.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Tested-by: Ricardo Neri --- Changes v3: - Addressed review comments, and added review-by from Mike kernel/liveupdate/kexec_handover.c | 39 ++++++++++++++++-------------- 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_h= andover.c index 9dc51fab604f..2d9ce33c63dc 100644 --- a/kernel/liveupdate/kexec_handover.c +++ b/kernel/liveupdate/kexec_handover.c @@ -460,27 +460,23 @@ static void __init deserialize_bitmap(unsigned int or= der, } } =20 -/* Return true if memory was deserizlied */ -static bool __init kho_mem_deserialize(const void *fdt) +/* Returns physical address of the preserved memory map from FDT */ +static phys_addr_t __init kho_get_mem_map_phys(const void *fdt) { - struct khoser_mem_chunk *chunk; const void *mem_ptr; - u64 mem; int len; =20 mem_ptr =3D fdt_getprop(fdt, 0, PROP_PRESERVED_MEMORY_MAP, &len); if (!mem_ptr || len !=3D sizeof(u64)) { pr_err("failed to get preserved memory bitmaps\n"); - return false; + return 0; } =20 - mem =3D get_unaligned((const u64 *)mem_ptr); - chunk =3D mem ? phys_to_virt(mem) : NULL; - - /* No preserved physical pages were passed, no deserialization */ - if (!chunk) - return false; + return get_unaligned((const u64 *)mem_ptr); +} =20 +static void __init kho_mem_deserialize(struct khoser_mem_chunk *chunk) +{ while (chunk) { unsigned int i; =20 @@ -489,8 +485,6 @@ static bool __init kho_mem_deserialize(const void *fdt) &chunk->bitmaps[i]); chunk =3D KHOSER_LOAD_PTR(chunk->hdr.next); } - - return true; } =20 /* @@ -1253,6 +1247,7 @@ bool kho_finalized(void) struct kho_in { phys_addr_t fdt_phys; phys_addr_t scratch_phys; + phys_addr_t mem_map_phys; struct kho_debugfs dbg; }; =20 @@ -1434,12 +1429,10 @@ static void __init kho_release_scratch(void) =20 void __init kho_memory_init(void) { - if (kho_in.scratch_phys) { + if (kho_in.mem_map_phys) { kho_scratch =3D phys_to_virt(kho_in.scratch_phys); kho_release_scratch(); - - if (!kho_mem_deserialize(kho_get_fdt())) - kho_in.fdt_phys =3D 0; + kho_mem_deserialize(phys_to_virt(kho_in.mem_map_phys)); } else { kho_reserve_scratch(); } @@ -1448,8 +1441,9 @@ void __init kho_memory_init(void) void __init kho_populate(phys_addr_t fdt_phys, u64 fdt_len, phys_addr_t scratch_phys, u64 scratch_len) { - void *fdt =3D NULL; struct kho_scratch *scratch =3D NULL; + phys_addr_t mem_map_phys; + void *fdt =3D NULL; int err =3D 0; unsigned int scratch_cnt =3D scratch_len / sizeof(*kho_scratch); =20 @@ -1475,6 +1469,14 @@ void __init kho_populate(phys_addr_t fdt_phys, u64 f= dt_len, goto out; } =20 + mem_map_phys =3D kho_get_mem_map_phys(fdt); + if (!mem_map_phys) { + pr_warn("setup: handover FDT (0x%llx) present but no preserved memory fo= und\n", + fdt_phys); + err =3D -ENOENT; + goto out; + } + scratch =3D early_memremap(scratch_phys, scratch_len); if (!scratch) { pr_warn("setup: failed to memremap scratch (phys=3D0x%llx, len=3D%lld)\n= ", @@ -1515,6 +1517,7 @@ void __init kho_populate(phys_addr_t fdt_phys, u64 fd= t_len, =20 kho_in.fdt_phys =3D fdt_phys; kho_in.scratch_phys =3D scratch_phys; + kho_in.mem_map_phys =3D mem_map_phys; kho_scratch_cnt =3D scratch_cnt; pr_info("found kexec handover data.\n"); =20 base-commit: ea1013c1539270e372fc99854bc6e4d94eaeff66 --=20 2.52.0.322.g1dd061c0dc-goog