If the previous kernel enabled KHO but did not call kho_finalize()
(e.g., CONFIG_LIVEUPDATE=n or userspace skipped the finalization step),
the 'preserved-memory-map' property in the FDT remains empty/zero.
Previously, kho_populate() would succeed regardless of the memory map's
state, reserving the incoming scratch regions in memblock. However,
kho_memory_init() would later fail to deserialize the empty map. By that
time, the scratch regions were already registered, leading to partial
initialization and subsequent list corruption (double-free) during
kho_init().
Move the validation of the preserved memory map earlier into
kho_populate(). If the memory map is empty/NULL:
1. Abort kho_populate() immediately with -ENOENT.
2. Do not register or reserve the incoming scratch memory, allowing the new
kernel to reclaim those pages as standard free memory.
3. Leave the global 'kho_in' state uninitialized.
Consequently, kho_memory_init() sees no active KHO context
(kho_in.mem_chunks is NULL) and falls back to kho_reserve_scratch(),
allocating fresh scratch memory as if it were a standard cold boot.
Fixes: de51999e687c ("kho: allow memory preservation state updates after
finalization")
Reported-by: Ricardo <[email protected]>
Closes:
https://lore.kernel.org/all/[email protected]
Signed-off-by: Pasha Tatashin <[email protected]>
---
kernel/liveupdate/kexec_handover.c | 36 +++++++++++++++++-------------
1 file changed, 21 insertions(+), 15 deletions(-)
diff --git a/kernel/liveupdate/kexec_handover.c
b/kernel/liveupdate/kexec_handover.c
index 9dc51fab604f..96c708f753d4 100644
--- a/kernel/liveupdate/kexec_handover.c
+++ b/kernel/liveupdate/kexec_handover.c
@@ -460,10 +460,9 @@ static void __init deserialize_bitmap(unsigned int order,
}
}
-/* Return true if memory was deserizlied */
-static bool __init kho_mem_deserialize(const void *fdt)
+/* Returns head of preserved physical memory chunks pointer from FDT */
+static struct khoser_mem_chunk * __init kho_get_mem_chunks(const void *fdt)
{
- struct khoser_mem_chunk *chunk;
const void *mem_ptr;
u64 mem;
int len;
@@ -471,16 +470,16 @@ static bool __init kho_mem_deserialize(const void *fdt)
mem_ptr = fdt_getprop(fdt, 0, PROP_PRESERVED_MEMORY_MAP, &len);
if (!mem_ptr || len != sizeof(u64)) {
pr_err("failed to get preserved memory bitmaps\n");
- return false;
+ return NULL;
}
mem = get_unaligned((const u64 *)mem_ptr);
- chunk = mem ? phys_to_virt(mem) : NULL;
- /* No preserved physical pages were passed, no deserialization */
- if (!chunk)
- return false;
+ return mem ? phys_to_virt(mem) : NULL;
+}
+static void __init kho_mem_deserialize(struct khoser_mem_chunk *chunk)
+{
while (chunk) {
unsigned int i;
@@ -489,8 +488,6 @@ static bool __init kho_mem_deserialize(const void *fdt)
&chunk->bitmaps[i]);
chunk = KHOSER_LOAD_PTR(chunk->hdr.next);
}
-
- return true;
}
/*
@@ -1253,6 +1250,7 @@ bool kho_finalized(void)
struct kho_in {
phys_addr_t fdt_phys;
phys_addr_t scratch_phys;
+ struct khoser_mem_chunk *mem_chunks;
struct kho_debugfs dbg;
};
@@ -1434,12 +1432,10 @@ static void __init kho_release_scratch(void)
void __init kho_memory_init(void)
{
- if (kho_in.scratch_phys) {
+ if (kho_in.mem_chunks) {
kho_scratch = phys_to_virt(kho_in.scratch_phys);
kho_release_scratch();
-
- if (!kho_mem_deserialize(kho_get_fdt()))
- kho_in.fdt_phys = 0;
+ kho_mem_deserialize(kho_in.mem_chunks);
} else {
kho_reserve_scratch();
}
@@ -1448,8 +1444,9 @@ void __init kho_memory_init(void)
void __init kho_populate(phys_addr_t fdt_phys, u64 fdt_len,
phys_addr_t scratch_phys, u64 scratch_len)
{
- void *fdt = NULL;
+ struct khoser_mem_chunk *mem_chunks;
struct kho_scratch *scratch = NULL;
+ void *fdt = NULL;
int err = 0;
unsigned int scratch_cnt = scratch_len / sizeof(*kho_scratch);
@@ -1475,6 +1472,14 @@ void __init kho_populate(phys_addr_t fdt_phys, u64
fdt_len,
goto out;
}
+ mem_chunks = kho_get_mem_chunks(fdt);
+ if (!mem_chunks) {
+ pr_warn("setup: handover FDT (0x%llx) present but no preserved
memory found\n",
+ fdt_phys);
+ err = -ENOENT;
+ goto out;
+ }
+
scratch = early_memremap(scratch_phys, scratch_len);
if (!scratch) {
pr_warn("setup: failed to memremap scratch (phys=0x%llx,
len=%lld)\n",
@@ -1515,6 +1520,7 @@ void __init kho_populate(phys_addr_t fdt_phys, u64
fdt_len,
kho_in.fdt_phys = fdt_phys;
kho_in.scratch_phys = scratch_phys;
+ kho_in.mem_chunks = mem_chunks;
kho_scratch_cnt = scratch_cnt;
pr_info("found kexec handover data.\n");
--
2.52.0.322.g1dd061c0dc-goog
