Re: [PATCH] kho: validate preserved memory map during population

[Ricardo Neri <ricardo.neri-calderon@linux.intel.com>]

On Thu, Dec 18, 2025 at 07:49:11PM -0500, Pasha Tatashin wrote:
> On Thu, Dec 18, 2025 at 7:23 PM Pasha Tatashin
> <pasha.tatashin@soleen.com> wrote:
> >
> > If the previous kernel enabled KHO but did not call kho_finalize()
> > (e.g., CONFIG_LIVEUPDATE=n or userspace skipped the finalization step),
> > the 'preserved-memory-map' property in the FDT remains empty/zero.
> >
> > Previously, kho_populate() would succeed regardless of the memory map's
> > state, reserving the incoming scratch regions in memblock. However,
> > kho_memory_init() would later fail to deserialize the empty map. By that
> > time, the scratch regions were already registered, leading to partial
> > initialization and subsequent list corruption (double-free) during
> > kho_init().
> >
> > Move the validation of the preserved memory map earlier into
> > kho_populate(). If the memory map is empty/NULL:
> > 1. Abort kho_populate() immediately with -ENOENT.
> > 2. Do not register or reserve the incoming scratch memory, allowing the new
> >    kernel to reclaim those pages as standard free memory.
> > 3. Leave the global 'kho_in' state uninitialized.
> >
> > Consequently, kho_memory_init() sees no active KHO context
> > (kho_in.mem_chunks is NULL) and falls back to kho_reserve_scratch(),
> > allocating fresh scratch memory as if it were a standard cold boot.
> >
> > Fixes: de51999e687c ("kho: allow memory preservation state updates after finalization")
> > Reported-by: Ricardo <ricardo@example.com>
> > Closes: https://lore.kernel.org/all/20251218215613.GA17304@ranerica-svr.sc.intel.com
> > Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> > ---
> >  kernel/liveupdate/kexec_handover.c | 36 +++++++++++++++++-------------
> >  1 file changed, 21 insertions(+), 15 deletions(-)
> >
> > diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
> > index 9dc51fab604f..96c708f753d4 100644
> > --- a/kernel/liveupdate/kexec_handover.c
> > +++ b/kernel/liveupdate/kexec_handover.c
> > @@ -460,10 +460,9 @@ static void __init deserialize_bitmap(unsigned int order,
> >         }
> >  }
> >
> > -/* Return true if memory was deserizlied */
> > -static bool __init kho_mem_deserialize(const void *fdt)
> > +/* Returns head of preserved physical memory chunks pointer from FDT */
> > +static struct khoser_mem_chunk * __init kho_get_mem_chunks(const void *fdt)
> >  {
> > -       struct khoser_mem_chunk *chunk;
> >         const void *mem_ptr;
> >         u64 mem;
> >         int len;
> > @@ -471,16 +470,16 @@ static bool __init kho_mem_deserialize(const void *fdt)
> >         mem_ptr = fdt_getprop(fdt, 0, PROP_PRESERVED_MEMORY_MAP, &len);
> >         if (!mem_ptr || len != sizeof(u64)) {
> >                 pr_err("failed to get preserved memory bitmaps\n");
> > -               return false;
> > +               return NULL;
> >         }
> >
> >         mem = get_unaligned((const u64 *)mem_ptr);
> > -       chunk = mem ? phys_to_virt(mem) : NULL;
> >
> > -       /* No preserved physical pages were passed, no deserialization */
> > -       if (!chunk)
> > -               return false;
> > +       return mem ? phys_to_virt(mem) : NULL;
> 
> I need to update this patch, phys_to_virt() should not be called from
> kho_populate() before KASLR is initialized. This causes a problem with
> my live update test. I will send a new version soon.

Thanks for the patch Pasha! FWIW, I no longer see the issue I reported.
I will test your v2 when posted.

BR,
Ricardo
> 
> Pasha