[PATCH] mm/memfd_luo: validate serialized_data before conversion

[PATCH] mm/memfd_luo: validate serialized_data before conversion

[Tarun Sahu]

In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
on args->serialized_data before checking if the physical address is valid.
Since physical address 0 does not map to virtual NULL (due to direct
mapping offsets), the subsequent check 'if (!ser)' was ineffective at
catching a missing serialized_data, leading to unsafe dereferences later.

Validate that args->serialized_data is non-zero before calling
phys_to_virt().

Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
Signed-off-by: Tarun Sahu <tarunsahu@google.com>
---
 mm/memfd_luo.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
index 59de210bee5f..10f3983b0060 100644
--- a/mm/memfd_luo.c
+++ b/mm/memfd_luo.c
@@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
 	if (args->retrieve_status)
 		return;
 
-	ser = phys_to_virt(args->serialized_data);
-	if (!ser)
+	if (!args->serialized_data)
 		return;
 
+	ser = phys_to_virt(args->serialized_data);
+
 	if (ser->nr_folios) {
 		folios_ser = kho_restore_vmalloc(&ser->folios);
 		if (!folios_ser)
@@ -522,10 +523,11 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
 	struct file *file;
 	int err;
 
-	ser = phys_to_virt(args->serialized_data);
-	if (!ser)
+	if (!args->serialized_data)
 		return -EINVAL;
 
+	ser = phys_to_virt(args->serialized_data);
+
 	/* Make sure the file only has seals supported by this version. */
 	if (ser->seals & ~MEMFD_LUO_ALL_SEALS) {
 		err = -EOPNOTSUPP;

base-commit: 9716c086c8e8b141d35aa61f2e96a2e83de212a7
-- 
2.54.0.1099.g489fc7bff1-goog

Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion

[Pratyush Yadav]

On Thu, Jun 11 2026, Tarun Sahu wrote:

> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> on args->serialized_data before checking if the physical address is valid.
> Since physical address 0 does not map to virtual NULL (due to direct

Nit: this is only true on ARM64. On x86 physical address of 0 maps to
NULL.

Other than this,

Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>

> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> catching a missing serialized_data, leading to unsafe dereferences later.
>
> Validate that args->serialized_data is non-zero before calling
> phys_to_virt().
>
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
[...]

-- 
Regards,
Pratyush Yadav

Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion

[Mike Rapoport]

On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> on args->serialized_data before checking if the physical address is valid.
> Since physical address 0 does not map to virtual NULL (due to direct
> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> catching a missing serialized_data, leading to unsafe dereferences later.
> 
> Validate that args->serialized_data is non-zero before calling
> phys_to_virt().
> 
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
> ---
>  mm/memfd_luo.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> index 59de210bee5f..10f3983b0060 100644
> --- a/mm/memfd_luo.c
> +++ b/mm/memfd_luo.c
> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
>  	if (args->retrieve_status)
>  		return;
>  
> -	ser = phys_to_virt(args->serialized_data);
> -	if (!ser)
> +	if (!args->serialized_data)

We really should make args->serialized_data a KHOSER_PTR

>  		return;
>  
> +	ser = phys_to_virt(args->serialized_data);
> +
>  	if (ser->nr_folios) {
>  		folios_ser = kho_restore_vmalloc(&ser->folios);
>  		if (!folios_ser)
> @@ -522,10 +523,11 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
>  	struct file *file;
>  	int err;
>  
> -	ser = phys_to_virt(args->serialized_data);
> -	if (!ser)
> +	if (!args->serialized_data)
>  		return -EINVAL;
>  
> +	ser = phys_to_virt(args->serialized_data);
> +
>  	/* Make sure the file only has seals supported by this version. */
>  	if (ser->seals & ~MEMFD_LUO_ALL_SEALS) {
>  		err = -EOPNOTSUPP;
> 
> base-commit: 9716c086c8e8b141d35aa61f2e96a2e83de212a7
> -- 
> 2.54.0.1099.g489fc7bff1-goog
> 

-- 
Sincerely yours,
Mike.

Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion

[Pratyush Yadav]

On Thu, Jun 11 2026, Mike Rapoport wrote:

> On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
>> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
>> on args->serialized_data before checking if the physical address is valid.
>> Since physical address 0 does not map to virtual NULL (due to direct
>> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
>> catching a missing serialized_data, leading to unsafe dereferences later.
>> 
>> Validate that args->serialized_data is non-zero before calling
>> phys_to_virt().
>> 
>> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
>> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
>> ---
>>  mm/memfd_luo.c | 10 ++++++----
>>  1 file changed, 6 insertions(+), 4 deletions(-)
>> 
>> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
>> index 59de210bee5f..10f3983b0060 100644
>> --- a/mm/memfd_luo.c
>> +++ b/mm/memfd_luo.c
>> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
>>  	if (args->retrieve_status)
>>  		return;
>>  
>> -	ser = phys_to_virt(args->serialized_data);
>> -	if (!ser)
>> +	if (!args->serialized_data)
>
> We really should make args->serialized_data a KHOSER_PTR

Hmm, that would also be a good idea. I suppose then it would be a better
to directly convert to using KHOSER_PTR() instead of this patch?

>
>>  		return;
>>  
>> +	ser = phys_to_virt(args->serialized_data);
>> +
>>  	if (ser->nr_folios) {
>>  		folios_ser = kho_restore_vmalloc(&ser->folios);
>>  		if (!folios_ser)
>> @@ -522,10 +523,11 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
>>  	struct file *file;
>>  	int err;
>>  
>> -	ser = phys_to_virt(args->serialized_data);
>> -	if (!ser)
>> +	if (!args->serialized_data)
>>  		return -EINVAL;
>>  
>> +	ser = phys_to_virt(args->serialized_data);
>> +
>>  	/* Make sure the file only has seals supported by this version. */
>>  	if (ser->seals & ~MEMFD_LUO_ALL_SEALS) {
>>  		err = -EOPNOTSUPP;
>> 
>> base-commit: 9716c086c8e8b141d35aa61f2e96a2e83de212a7
>> -- 
>> 2.54.0.1099.g489fc7bff1-goog
>> 

-- 
Regards,
Pratyush Yadav

Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion

[Mike Rapoport]

On Thu, Jun 11, 2026 at 03:37:12PM +0200, Pratyush Yadav wrote:
> On Thu, Jun 11 2026, Mike Rapoport wrote:
> 
> > On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
> >> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> >> on args->serialized_data before checking if the physical address is valid.
> >> Since physical address 0 does not map to virtual NULL (due to direct
> >> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> >> catching a missing serialized_data, leading to unsafe dereferences later.
> >> 
> >> Validate that args->serialized_data is non-zero before calling
> >> phys_to_virt().
> >> 
> >> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> >> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
> >> ---
> >>  mm/memfd_luo.c | 10 ++++++----
> >>  1 file changed, 6 insertions(+), 4 deletions(-)
> >> 
> >> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> >> index 59de210bee5f..10f3983b0060 100644
> >> --- a/mm/memfd_luo.c
> >> +++ b/mm/memfd_luo.c
> >> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
> >>  	if (args->retrieve_status)
> >>  		return;
> >>  
> >> -	ser = phys_to_virt(args->serialized_data);
> >> -	if (!ser)
> >> +	if (!args->serialized_data)
> >
> > We really should make args->serialized_data a KHOSER_PTR
> 
> Hmm, that would also be a good idea. I suppose then it would be a better
> to directly convert to using KHOSER_PTR() instead of this patch?

Makes sense.
 
> -- 
> Regards,
> Pratyush Yadav

-- 
Sincerely yours,
Mike.

Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion

[Pasha Tatashin]

On 06-11 17:28, Mike Rapoport wrote:
> On Thu, Jun 11, 2026 at 03:37:12PM +0200, Pratyush Yadav wrote:
> > On Thu, Jun 11 2026, Mike Rapoport wrote:
> > 
> > > On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
> > >> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> > >> on args->serialized_data before checking if the physical address is valid.
> > >> Since physical address 0 does not map to virtual NULL (due to direct
> > >> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> > >> catching a missing serialized_data, leading to unsafe dereferences later.
> > >> 
> > >> Validate that args->serialized_data is non-zero before calling
> > >> phys_to_virt().
> > >> 
> > >> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> > >> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
> > >> ---
> > >>  mm/memfd_luo.c | 10 ++++++----
> > >>  1 file changed, 6 insertions(+), 4 deletions(-)
> > >> 
> > >> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> > >> index 59de210bee5f..10f3983b0060 100644
> > >> --- a/mm/memfd_luo.c
> > >> +++ b/mm/memfd_luo.c
> > >> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
> > >>  	if (args->retrieve_status)
> > >>  		return;
> > >>  
> > >> -	ser = phys_to_virt(args->serialized_data);
> > >> -	if (!ser)
> > >> +	if (!args->serialized_data)
> > >
> > > We really should make args->serialized_data a KHOSER_PTR
> > 
> > Hmm, that would also be a good idea. I suppose then it would be a better
> > to directly convert to using KHOSER_PTR() instead of this patch?
> 
> Makes sense.

I think we should systematically cover all  phys_to_virt  conversions 
and add  KOSHER_PTR() , instead of an ad-hoc approach of adding it as we 
go. So, let's take this patch and do a series where we properly convert 
everything and provide guidance for others to use going forward.

Pasha

>  
> > -- 
> > Regards,
> > Pratyush Yadav
> 
> -- 
> Sincerely yours,
> Mike.

Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion

[Mike Rapoport]

On Thu, Jun 11, 2026 at 06:11:13PM +0000, Pasha Tatashin wrote:
> On 06-11 17:28, Mike Rapoport wrote:
> > On Thu, Jun 11, 2026 at 03:37:12PM +0200, Pratyush Yadav wrote:
> > > On Thu, Jun 11 2026, Mike Rapoport wrote:
> > > 
> > > > On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
> > > >> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> > > >> on args->serialized_data before checking if the physical address is valid.
> > > >> Since physical address 0 does not map to virtual NULL (due to direct
> > > >> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> > > >> catching a missing serialized_data, leading to unsafe dereferences later.
> > > >> 
> > > >> Validate that args->serialized_data is non-zero before calling
> > > >> phys_to_virt().
> > > >> 
> > > >> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> > > >> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
> > > >> ---
> > > >>  mm/memfd_luo.c | 10 ++++++----
> > > >>  1 file changed, 6 insertions(+), 4 deletions(-)
> > > >> 
> > > >> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> > > >> index 59de210bee5f..10f3983b0060 100644
> > > >> --- a/mm/memfd_luo.c
> > > >> +++ b/mm/memfd_luo.c
> > > >> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
> > > >>  	if (args->retrieve_status)
> > > >>  		return;
> > > >>  
> > > >> -	ser = phys_to_virt(args->serialized_data);
> > > >> -	if (!ser)
> > > >> +	if (!args->serialized_data)
> > > >
> > > > We really should make args->serialized_data a KHOSER_PTR
> > > 
> > > Hmm, that would also be a good idea. I suppose then it would be a better
> > > to directly convert to using KHOSER_PTR() instead of this patch?
> > 
> > Makes sense.
> 
> I think we should systematically cover all  phys_to_virt  conversions 
> and add  KOSHER_PTR() , instead of an ad-hoc approach of adding it as we 
> go. So, let's take this patch and do a series where we properly convert 
> everything and provide guidance for others to use going forward.

It's too late for this patch for -rc1. So let's systematically convert all
4 or 5 direct phys_to_virt() conversions in the next cycle and be done with
it.

We have enough time to make it by -rc2.
 
> Pasha

-- 
Sincerely yours,
Mike.

Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion

[tarunsahu]

Mike Rapoport <rppt@kernel.org> writes:

> On Thu, Jun 11, 2026 at 06:11:13PM +0000, Pasha Tatashin wrote:
>> On 06-11 17:28, Mike Rapoport wrote:
>> > On Thu, Jun 11, 2026 at 03:37:12PM +0200, Pratyush Yadav wrote:
>> > > On Thu, Jun 11 2026, Mike Rapoport wrote:
>> > > 
>> > > > On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
>> > > >> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
>> > > >> on args->serialized_data before checking if the physical address is valid.
>> > > >> Since physical address 0 does not map to virtual NULL (due to direct
>> > > >> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
>> > > >> catching a missing serialized_data, leading to unsafe dereferences later.
>> > > >> 
>> > > >> Validate that args->serialized_data is non-zero before calling
>> > > >> phys_to_virt().
>> > > >> 
>> > > >> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
>> > > >> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
>> > > >> ---
>> > > >>  mm/memfd_luo.c | 10 ++++++----
>> > > >>  1 file changed, 6 insertions(+), 4 deletions(-)
>> > > >> 
>> > > >> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
>> > > >> index 59de210bee5f..10f3983b0060 100644
>> > > >> --- a/mm/memfd_luo.c
>> > > >> +++ b/mm/memfd_luo.c
>> > > >> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
>> > > >>  	if (args->retrieve_status)
>> > > >>  		return;
>> > > >>  
>> > > >> -	ser = phys_to_virt(args->serialized_data);
>> > > >> -	if (!ser)
>> > > >> +	if (!args->serialized_data)
>> > > >
>> > > > We really should make args->serialized_data a KHOSER_PTR
>> > > 
>> > > Hmm, that would also be a good idea. I suppose then it would be a better
>> > > to directly convert to using KHOSER_PTR() instead of this patch?
>> > 
>> > Makes sense.
>> 
>> I think we should systematically cover all  phys_to_virt  conversions 
>> and add  KOSHER_PTR() , instead of an ad-hoc approach of adding it as we 
>> go. So, let's take this patch and do a series where we properly convert 
>> everything and provide guidance for others to use going forward.
>
> It's too late for this patch for -rc1. So let's systematically convert all
> 4 or 5 direct phys_to_virt() conversions in the next cycle and be done with
> it.
>
> We have enough time to make it by -rc2.

I am already working on converitng them to use KHOSER_PTR. I have patch
ready, Will send soon after some testing.

~Tarun

>  
>> Pasha
>
> -- 
> Sincerely yours,
> Mike.

Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion

[Pasha Tatashin]

On 06-11 10:30, Tarun Sahu wrote:
> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> on args->serialized_data before checking if the physical address is valid.
> Since physical address 0 does not map to virtual NULL (due to direct
> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> catching a missing serialized_data, leading to unsafe dereferences later.
> 
> Validate that args->serialized_data is non-zero before calling
> phys_to_virt().
> 
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Signed-off-by: Tarun Sahu <tarunsahu@google.com>

Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> 

> ---
>  mm/memfd_luo.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> index 59de210bee5f..10f3983b0060 100644
> --- a/mm/memfd_luo.c
> +++ b/mm/memfd_luo.c
> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
>  	if (args->retrieve_status)
>  		return;
>  
> -	ser = phys_to_virt(args->serialized_data);
> -	if (!ser)
> +	if (!args->serialized_data)
>  		return;
>  
> +	ser = phys_to_virt(args->serialized_data);
> +
>  	if (ser->nr_folios) {
>  		folios_ser = kho_restore_vmalloc(&ser->folios);
>  		if (!folios_ser)
> @@ -522,10 +523,11 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
>  	struct file *file;
>  	int err;
>  
> -	ser = phys_to_virt(args->serialized_data);
> -	if (!ser)
> +	if (!args->serialized_data)
>  		return -EINVAL;
>  
> +	ser = phys_to_virt(args->serialized_data);
> +
>  	/* Make sure the file only has seals supported by this version. */
>  	if (ser->seals & ~MEMFD_LUO_ALL_SEALS) {
>  		err = -EOPNOTSUPP;
> 
> base-commit: 9716c086c8e8b141d35aa61f2e96a2e83de212a7
> -- 
> 2.54.0.1099.g489fc7bff1-goog
>