linux-kernel - Re: [PATCH] kho: validate preserved memory map during population

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+CK2bAOMooH+NE5YanRyfK0KraRug2VHT_M59UpbiD5T2qu-w@mail.gmail.com>
Date: Thu, 18 Dec 2025 19:49:11 -0500
From: Pasha Tatashin <pasha.tatashin@...een.com>
To: akpm@...ux-foundation.org, pasha.tatashin@...een.com, rppt@...nel.org, 
	graf@...zon.com, linux-kernel@...r.kernel.org, kexec@...ts.infradead.org, 
	linux-mm@...ck.org, pratyush@...nel.org, 
	ricardo.neri-calderon@...ux.intel.com
Subject: Re: [PATCH] kho: validate preserved memory map during population

On Thu, Dec 18, 2025 at 7:23 PM Pasha Tatashin
<pasha.tatashin@...een.com> wrote:
>
> If the previous kernel enabled KHO but did not call kho_finalize()
> (e.g., CONFIG_LIVEUPDATE=n or userspace skipped the finalization step),
> the 'preserved-memory-map' property in the FDT remains empty/zero.
>
> Previously, kho_populate() would succeed regardless of the memory map's
> state, reserving the incoming scratch regions in memblock. However,
> kho_memory_init() would later fail to deserialize the empty map. By that
> time, the scratch regions were already registered, leading to partial
> initialization and subsequent list corruption (double-free) during
> kho_init().
>
> Move the validation of the preserved memory map earlier into
> kho_populate(). If the memory map is empty/NULL:
> 1. Abort kho_populate() immediately with -ENOENT.
> 2. Do not register or reserve the incoming scratch memory, allowing the new
>    kernel to reclaim those pages as standard free memory.
> 3. Leave the global 'kho_in' state uninitialized.
>
> Consequently, kho_memory_init() sees no active KHO context
> (kho_in.mem_chunks is NULL) and falls back to kho_reserve_scratch(),
> allocating fresh scratch memory as if it were a standard cold boot.
>
> Fixes: de51999e687c ("kho: allow memory preservation state updates after finalization")
> Reported-by: Ricardo <ricardo@...mple.com>
> Closes: https://lore.kernel.org/all/20251218215613.GA17304@ranerica-svr.sc.intel.com
> Signed-off-by: Pasha Tatashin <pasha.tatashin@...een.com>
> ---
>  kernel/liveupdate/kexec_handover.c | 36 +++++++++++++++++-------------
>  1 file changed, 21 insertions(+), 15 deletions(-)
>
> diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
> index 9dc51fab604f..96c708f753d4 100644
> --- a/kernel/liveupdate/kexec_handover.c
> +++ b/kernel/liveupdate/kexec_handover.c
> @@ -460,10 +460,9 @@ static void __init deserialize_bitmap(unsigned int order,
>         }
>  }
>
> -/* Return true if memory was deserizlied */
> -static bool __init kho_mem_deserialize(const void *fdt)
> +/* Returns head of preserved physical memory chunks pointer from FDT */
> +static struct khoser_mem_chunk * __init kho_get_mem_chunks(const void *fdt)
>  {
> -       struct khoser_mem_chunk *chunk;
>         const void *mem_ptr;
>         u64 mem;
>         int len;
> @@ -471,16 +470,16 @@ static bool __init kho_mem_deserialize(const void *fdt)
>         mem_ptr = fdt_getprop(fdt, 0, PROP_PRESERVED_MEMORY_MAP, &len);
>         if (!mem_ptr || len != sizeof(u64)) {
>                 pr_err("failed to get preserved memory bitmaps\n");
> -               return false;
> +               return NULL;
>         }
>
>         mem = get_unaligned((const u64 *)mem_ptr);
> -       chunk = mem ? phys_to_virt(mem) : NULL;
>
> -       /* No preserved physical pages were passed, no deserialization */
> -       if (!chunk)
> -               return false;
> +       return mem ? phys_to_virt(mem) : NULL;

I need to update this patch, phys_to_virt() should not be called from
kho_populate() before KASLR is initialized. This causes a problem with
my live update test. I will send a new version soon.

Pasha