[PATCH 6.18.y 0/2] kho: free buddy-allocated metadata with free_page()

[PATCH 6.18.y 0/2] kho: free buddy-allocated metadata with free_page()

[Federico Parola]

Commit fa759cd75bce ("kho: allocate metadata directly from the buddy
allocator"), merged in 6.18, moved the KHO serialization chunks and the
preserved memory bitmaps from kzalloc() to get_zeroed_page(). Two places
still release them with kfree(): kho_mem_ser_free() for the chunks and
__kho_abort() for the bitmaps. kfree() on such a page hits the
WARN_ON_ONCE() in free_large_kmalloc() and returns without freeing it,
so each aborted or failed KHO finalization leaks the metadata pages.

Patch 1 is a clean backport of the upstream fix for the chunks.

Patch 2 fixes the bitmaps and has no upstream counterpart. Upstream
removed the tracking teardown from __kho_abort() in commit 99cd2ffac697
("kho: don't unpreserve memory during abort"), which relies on the
unpreserve interfaces and the notifier removal that came with 6.19. In
6.18.y, KHO users still preserve memory from the KEXEC_KHO_FINALIZE
notifier, and the teardown on abort is the only thing that drops those
preservations. I kept it and changed only the free; patch 2 has the
details.

Federico Parola (1):
  kho: free phys_bits bitmaps using free_page() in __kho_abort()

Pratyush Yadav (1):
  kho: free chunks using free_page() instead of kfree()

 kernel/kexec_handover.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.47.3

[PATCH 6.18.y 1/2] kho: free chunks using free_page() instead of kfree()

[Federico Parola]

From: Pratyush Yadav <pratyush@kernel.org>

[ Upstream commit b15515155af735a86e5bcd67ed739162f0de27f5 ]

Before commit fa759cd75bce5 ("kho: allocate metadata directly from the
buddy allocator"), the chunks were allocated from the slab allocator using
kzalloc().  Those were rightly freed using kfree().

When the commit switched to using the buddy allocator directly, it missed
updating kho_mem_ser_free() to use free_page() instead of kfree().

Link: https://lkml.kernel.org/r/20251118182218.63044-1-pratyush@kernel.org
Fixes: fa759cd75bce5 ("kho: allocate metadata directly from the buddy allocator")
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Alexander Graf <graf@amazon.com>
Cc: David Matlack <dmatlack@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Federico Parola <fparola@amazon.de>
---
 kernel/kexec_handover.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/kexec_handover.c b/kernel/kexec_handover.c
index ac9fa7727b5ff..9fe5d14f1ec54 100644
--- a/kernel/kexec_handover.c
+++ b/kernel/kexec_handover.c
@@ -365,7 +365,7 @@ static void kho_mem_ser_free(struct khoser_mem_chunk *first_chunk)
 		struct khoser_mem_chunk *tmp = chunk;
 
 		chunk = KHOSER_LOAD_PTR(chunk->hdr.next);
-		kfree(tmp);
+		free_page((unsigned long)tmp);
 	}
 }
 
-- 
2.47.3

[PATCH 6.18.y 2/2] kho: free phys_bits bitmaps using free_page() in __kho_abort()

[Federico Parola]

Commit fa759cd75bce ("kho: allocate metadata directly from the buddy
allocator") switched the allocation of preserved memory bitmaps to
get_zeroed_page(), but __kho_abort() still releases them with kfree().
kfree() on a buddy page that is not a large kmalloc allocation hits the
WARN_ON_ONCE() in free_large_kmalloc() and returns without freeing it,
so every aborted finalization leaks all bitmap pages.

Free the bitmaps with free_page() instead.

This is a stable-only patch. Upstream fixed it as a side effect of
commit 99cd2ffac697 ("kho: don't unpreserve memory during abort"), which
removes the tracking teardown from __kho_abort() altogether. That change
builds on commit 36f8f7ef7fd2 ("kho: add interfaces to unpreserve
folios, page ranges, and vmalloc") and commit 70f9133096c8 ("kho: drop
notifiers"). In 6.18.y, KHO users still preserve memory from the
KEXEC_KHO_FINALIZE notifier and have no interface to unpreserve it, so
the teardown on abort is the only way their preservations get dropped.
Backporting that commit would make preservations outlive every abort,
so keep the teardown and fix only the mismatched free.

Fixes: fa759cd75bce ("kho: allocate metadata directly from the buddy allocator")
Signed-off-by: Federico Parola <fparola@amazon.de>
---
 kernel/kexec_handover.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/kexec_handover.c b/kernel/kexec_handover.c
index 9fe5d14f1ec54..9691f6bc2fba7 100644
--- a/kernel/kexec_handover.c
+++ b/kernel/kexec_handover.c
@@ -1054,7 +1054,7 @@ static int __kho_abort(void)
 		unsigned long phys;
 
 		xa_for_each(&physxa->phys_bits, phys, bits)
-			kfree(bits);
+			free_page((unsigned long)bits);
 
 		xa_destroy(&physxa->phys_bits);
 		kfree(physxa);
-- 
2.47.3

Re: [PATCH 6.18.y 1/2] kho: free chunks using free_page() instead of kfree()

[sashiko-bot]

> From: Pratyush Yadav <pratyush@kernel.org>
> 
> [ Upstream commit b15515155af735a86e5bcd67ed739162f0de27f5 ]
> 
> Before commit fa759cd75bce5 ("kho: allocate metadata directly from the
> buddy allocator"), the chunks were allocated from the slab allocator using
> kzalloc().  Those were rightly freed using kfree().
> 
> When the commit switched to using the buddy allocator directly, it missed
> updating kho_mem_ser_free() to use free_page() instead of kfree().
> 
> Link: https://lkml.kernel.org/r/20251118182218.63044-1-pratyush@kernel.org
> Fixes: fa759cd75bce5 ("kho: allocate metadata directly from the buddy allocator")
> Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
> Cc: Alexander Graf <graf@amazon.com>
> Cc: David Matlack <dmatlack@google.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Federico Parola <fparola@amazon.de>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015144529.76911-1-fparola@amazon.de?part=1

Re: [PATCH 6.18.y 2/2] kho: free phys_bits bitmaps using free_page() in __kho_abort()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] mm: use-after-free of physxa in __kho_preserve_order() racing with abort
- [Medium] mm: memory leak of kho_vmalloc_chunk pages on KHO abort
--

commit a7bcf7c6e605c88c110bdd87cec6fe96445bb703
Author: Federico Parola <fparola@amazon.de>

kho: free phys_bits bitmaps using free_page() in __kho_abort()

This commit fixes a memory leak in KHO abort by replacing kfree() with
free_page() for releasing bitmap pages allocated via the buddy allocator.
Using kfree() on non-kmalloc buddy pages previously hit a WARN_ON_ONCE() and
leaked the pages during teardown.

> diff --git a/kernel/kexec_handover.c b/kernel/kexec_handover.c
> index 9fe5d14f1ec54..9691f6bc2fba7 100644
> --- a/kernel/kexec_handover.c
> +++ b/kernel/kexec_handover.c
> @@ -1054,7 +1054,7 @@ static int __kho_abort(void)
>  		unsigned long phys;
>  
>  		xa_for_each(&physxa->phys_bits, phys, bits)
> -			kfree(bits);
> +			free_page((unsigned long)bits);
>  
>  		xa_destroy(&physxa->phys_bits);
>  		kfree(physxa);

[Severity: High]
Does this code introduce a use-after-free? The physxa structure is freed
without being removed from the XArray first, leaving a dangling pointer
visible to lockless readers until xa_destroy(&kho_out.ser.track.orders)
eventually clears the array.

If a driver calls kho_preserve_folio() concurrently with another thread
calling kho_abort(), could __kho_preserve_order() load the physxa pointer
locklessly and dereference it just after it is freed here?

kernel/kexec_handover.c:__kho_preserve_order() {
    ...
    physxa = xa_load(&track->orders, order);
    if (!physxa) {
        ...
    }

    bits = xa_load_or_alloc(&physxa->phys_bits, pfn_high / PRESERVE_BITS);
    ...
}

[Severity: Medium]
Does this code leak kho_vmalloc_chunk pages? When __kho_abort() drops the KHO
state by destroying the XArrays, it leaves the driver's metadata chunk
pages untracked.

In kho_preserve_vmalloc(), these pages are allocated and linked only to the
driver's struct kho_vmalloc object:

kernel/kexec_handover.c:kho_preserve_vmalloc() {
    ...
    chunk = new_vmalloc_chunk(NULL);
    if (!chunk)
        return -ENOMEM;
    KHOSER_STORE_PTR(preservation->first, chunk);
    ...
}

Since kho_vmalloc_free_chunks() is static, and there is no exported
kho_vmalloc_unpreserve() API, drivers cannot free these chunks inside their
KEXEC_KHO_ABORT notifiers. Doesn't this mean these pages are permanently
leaked whenever KHO finalization is aborted?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015144529.76911-1-fparola@amazon.de?part=2