linux-kernel - [PATCH 0/2] liveupdate: fixes in error handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260126230302.2936817-1-pratyush@kernel.org>
Date: Tue, 27 Jan 2026 00:02:51 +0100
From: Pratyush Yadav <pratyush@...nel.org>
To: Pasha Tatashin <pasha.tatashin@...een.com>,
	Mike Rapoport <rppt@...nel.org>,
	Pratyush Yadav <pratyush@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>
Cc: linux-kernel@...r.kernel.org,
	linux-mm@...ck.org
Subject: [PATCH 0/2] liveupdate: fixes in error handling

From: "Pratyush Yadav (Google)" <pratyush@...nel.org>

Hi Andrew,

This series contains some fixes in LUO's error handling paths.

The first patch deals with failed freeze() attempts. The cleanup path
calls unfreeze, and that clears some data needed by later unpreserve
calls.

The second patch is a bit more involved. It deals with failed retrieve()
attempts. To do so properly, it reworks some of the error handling logic
in luo_file core.

Both these fixes are "theoretical" -- in the sense that I have not been
able to reproduce either of them in normal operation. The only supported
file type right now is memfd, and there is nothing userspace can do
right now to make it fail its retrieve or freeze. I need to make the
retrieve or freeze fail by artificially injecting errors. The injected
errors trigger a use-after-free and a double-free.

That said, once more complex file handlers are added or memfd
preservation is used in ways not currently expected or covered by the
tests, we will be able to see them on real systems.

Regards,
Pratyush Yadav

Pratyush Yadav (Google) (2):
  liveupdate: luo_file: do not clear serialized_data on unfreeze
  liveupdate: luo_file: remember retrieve() status

 include/linux/liveupdate.h   |  7 ++++--
 kernel/liveupdate/luo_file.c | 43 +++++++++++++++++++++---------------
 mm/memfd_luo.c               |  7 +++++-
 3 files changed, 36 insertions(+), 21 deletions(-)

base-commit: 2e833046d66a40f9ad3de2948e6ecd791939fa59
-- 
2.52.0.457.g6b5491de43-goog