From nobody Sun Feb 8 12:19:04 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB9CF30DD24 for ; Mon, 26 Jan 2026 23:03:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769468598; cv=none; b=kUriE0ywkKbrr+su6ErpYxbUN4LJ5DdGhxkReAgPvfpioTiN7NCyFTQPUSXP53kurfgK7WW9MqNRVjuNMrm63gveFOcuPaOmC3EGY518XIh5AZ2MPlPTGbp25E1wEag1H918CP2EIiv5GSwVpHKlKYEObmsoBdDIyTRjCbCfl98= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769468598; c=relaxed/simple; bh=90DvFCi3zMuXdUi5plIxqndw6Xsg6xyFIhBnu4feXwc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lMT02q1GZ+z3f32S5MeJKgP11CRLBUhyCTCau0Kkie7b5VGSbHRLUKzIlTGjs3SXYdvH311U0tQa6ZKarnzZmOYngKXT52InfeDsFkjY67c09DV/5dnJnRVOJbhZLlfPTMzQiNxUpgyp60nRfhbRszYb8owfYiQD9Cpmj2Ys1Ec= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KfjKV6Tw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KfjKV6Tw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AFC43C116C6; Mon, 26 Jan 2026 23:03:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1769468597; bh=90DvFCi3zMuXdUi5plIxqndw6Xsg6xyFIhBnu4feXwc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KfjKV6Twh01q8uGSY9sQx98QO+lL29jXatucMnVHcz80uw7Lq4btEHGodgOivS6Li P1n90vvA2MwJLRbyslE/KZMGsqzUVGuT7xMPuXb7R8c95UcIR1sAotbgaICiT1QuvF eVyKuszZLSN+gnaw+O1tNwH9jFLoXiv4YezklZLEbGHmrsgh7N7Xq1V+TT7km2dtk3 ybAyrLSHmtOwstf8g4ao143cEiMWL4GN9dyyKQ7Xdd6+IKtmPnwjfMVX0wA63iioBx wWFIQQycJNDEzLQctgmyJDe5/aSlB4Ue8j+YKLIua24jo4tBMzth1+dJB6S/T5dnCa Cx0ZTfqsYLrMQ== From: Pratyush Yadav To: Pasha Tatashin , Mike Rapoport , Pratyush Yadav , Andrew Morton Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 2/2] liveupdate: luo_file: remember retrieve() status Date: Tue, 27 Jan 2026 00:02:53 +0100 Message-ID: <20260126230302.2936817-3-pratyush@kernel.org> X-Mailer: git-send-email 2.52.0.457.g6b5491de43-goog In-Reply-To: <20260126230302.2936817-1-pratyush@kernel.org> References: <20260126230302.2936817-1-pratyush@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Pratyush Yadav (Google)" LUO keeps track of successful retrieve attempts on a LUO file. It does so to avoid multiple retrievals of the same file. Doing so will cause problems because once the file is retrieved, the serialized data structures are likely freed and the file is likely in a very different state from what the code expects. This is kept track of by the retrieved boolean in struct luo_file, and is passed to the finish callback so it knows what work was already done and what it has left to do. All this works well when retrieve succeeds. When it fails, luo_retrieve_file() returns the error immediately, without ever storing anywhere that a retrieve was attempted or what its error code was. This results in an errored LIVEUPDATE_SESSION_RETRIEVE_FD ioctl to userspace, but nothing prevents it from trying this again. The retry is problematic for much of the same reasons listed above. The file is likely in a very different state than what the retrieve logic normally expects, and it might even have freed some serialization data structures. Attempting to access them or free them again is going to break things. For example, if memfd managed to restore 8 of its 10 folios, but fails on the 9th, a subsequent retrieve attempt will try to call kho_restore_folio() on the first folio again, and that will fail with a warning since it is an invalid operation. Apart from the retry, finish() also breaks. Since on failure the retrieved bool in luo_file is never touched, the finish() call on session close will tell the file handler that retrieve was never attempted, and it will try to access or free the data structures that might not exist, much in the same way as the retry attempt. There is no sane way of attempting the retrieve again. Remember the error retrieve returned and directly return it on a retry. Also pass this status code to finish() so it can make the right decision on the work it needs to do. This is done by changing the bool to an integer. A value of 0 means retrieve was never attempted, a positive value means it succeeded, and a negative value means it failed and the error code is the value. Fixes: 7c722a7f44e0 ("liveupdate: luo_file: implement file systems callback= s") Signed-off-by: Pratyush Yadav (Google) --- include/linux/liveupdate.h | 7 ++++-- kernel/liveupdate/luo_file.c | 41 ++++++++++++++++++++++-------------- mm/memfd_luo.c | 7 +++++- 3 files changed, 36 insertions(+), 19 deletions(-) diff --git a/include/linux/liveupdate.h b/include/linux/liveupdate.h index a7f6ee5b6771..a543a3a8e837 100644 --- a/include/linux/liveupdate.h +++ b/include/linux/liveupdate.h @@ -21,7 +21,10 @@ struct file; * struct liveupdate_file_op_args - Arguments for file operation callbacks. * @handler: The file handler being called. * @retrieved: The retrieve status for the 'can_finish / finish' - * operation. + * operation. A value of 0 means the retrieve has not b= een + * attempted, a positive value means the retrieve was + * successful, and a negative value means the retrieve = failed, + * and the value is the error code of the call. * @file: The file object. For retrieve: [OUT] The callback se= ts * this to the new file. For other ops: [IN] The caller= sets * this to the file being operated on. @@ -37,7 +40,7 @@ struct file; */ struct liveupdate_file_op_args { struct liveupdate_file_handler *handler; - bool retrieved; + bool retrieve_sts; struct file *file; u64 serialized_data; void *private_data; diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c index 9f7283379ebc..82577b4cca2b 100644 --- a/kernel/liveupdate/luo_file.c +++ b/kernel/liveupdate/luo_file.c @@ -133,9 +133,12 @@ static LIST_HEAD(luo_file_handler_list); * state that is not preserved. Set by the handler's .pres= erve() * callback, and must be freed in the handler's .unpreserv= e() * callback. - * @retrieved: A flag indicating whether a user/kernel in the new kern= el has + * @retrieve_sts: Status code indicating whether a user/kernel in the new= kernel has * successfully called retrieve() on this file. This preve= nts - * multiple retrieval attempts. + * multiple retrieval attempts. A value of 0 means a retri= eve() + * has not been attempted, a positive value means the retr= ieve() + * was successful, and a negative value means the retrieve= () + * failed, and the value is the error code of the call. * @mutex: A mutex that protects the fields of this specific insta= nce * (e.g., @retrieved, @file), ensuring that operations like * retrieving or finishing a file are atomic. @@ -160,7 +163,7 @@ struct luo_file { struct file *file; u64 serialized_data; void *private_data; - bool retrieved; + int retrieve_sts; struct mutex mutex; struct list_head list; u64 token; @@ -293,7 +296,7 @@ int luo_preserve_file(struct luo_file_set *file_set, u6= 4 token, int fd) luo_file->file =3D file; luo_file->fh =3D fh; luo_file->token =3D token; - luo_file->retrieved =3D false; + luo_file->retrieve_sts =3D 0; mutex_init(&luo_file->mutex); =20 args.handler =3D fh; @@ -569,7 +572,7 @@ int luo_retrieve_file(struct luo_file_set *file_set, u6= 4 token, return -ENOENT; =20 guard(mutex)(&luo_file->mutex); - if (luo_file->retrieved) { + if (luo_file->retrieve_sts > 0) { /* * Someone is asking for this file again, so get a reference * for them. @@ -577,21 +580,27 @@ int luo_retrieve_file(struct luo_file_set *file_set, = u64 token, get_file(luo_file->file); *filep =3D luo_file->file; return 0; + } else if (luo_file->retrieve_sts < 0) { + /* Retrieve was attempted and it failed. Return the error code. */ + return luo_file->retrieve_sts; } =20 args.handler =3D luo_file->fh; args.serialized_data =3D luo_file->serialized_data; err =3D luo_file->fh->ops->retrieve(&args); - if (!err) { - luo_file->file =3D args.file; - - /* Get reference so we can keep this file in LUO until finish */ - get_file(luo_file->file); - *filep =3D luo_file->file; - luo_file->retrieved =3D true; + if (err) { + /* Keep the error code for later use. */ + luo_file->retrieve_sts =3D err; + return err; } =20 - return err; + luo_file->file =3D args.file; + /* Get reference so we can keep this file in LUO until finish */ + get_file(luo_file->file); + *filep =3D luo_file->file; + luo_file->retrieve_sts =3D 1; + + return 0; } =20 static int luo_file_can_finish_one(struct luo_file_set *file_set, @@ -607,7 +616,7 @@ static int luo_file_can_finish_one(struct luo_file_set = *file_set, args.handler =3D luo_file->fh; args.file =3D luo_file->file; args.serialized_data =3D luo_file->serialized_data; - args.retrieved =3D luo_file->retrieved; + args.retrieve_sts =3D luo_file->retrieve_sts; can_finish =3D luo_file->fh->ops->can_finish(&args); } =20 @@ -624,7 +633,7 @@ static void luo_file_finish_one(struct luo_file_set *fi= le_set, args.handler =3D luo_file->fh; args.file =3D luo_file->file; args.serialized_data =3D luo_file->serialized_data; - args.retrieved =3D luo_file->retrieved; + args.retrieve_sts =3D luo_file->retrieve_sts; =20 luo_file->fh->ops->finish(&args); } @@ -779,7 +788,7 @@ int luo_file_deserialize(struct luo_file_set *file_set, luo_file->file =3D NULL; luo_file->serialized_data =3D file_ser[i].data; luo_file->token =3D file_ser[i].token; - luo_file->retrieved =3D false; + luo_file->retrieve_sts =3D 0; mutex_init(&luo_file->mutex); list_add_tail(&luo_file->list, &file_set->files_list); } diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c index a34fccc23b6a..ffc9f879833b 100644 --- a/mm/memfd_luo.c +++ b/mm/memfd_luo.c @@ -326,7 +326,12 @@ static void memfd_luo_finish(struct liveupdate_file_op= _args *args) struct memfd_luo_folio_ser *folios_ser; struct memfd_luo_ser *ser; =20 - if (args->retrieved) + /* + * If retrieve was successful, nothing to do. If it failed, retrieve() + * already cleaned up everything it could. So nothing to do there + * either. Only need to clean up when retrieve was not called. + */ + if (args->retrieve_sts) return; =20 ser =3D phys_to_virt(args->serialized_data); --=20 2.52.0.457.g6b5491de43-goog