[PATCH 0/2] liveupdate: prevent double management of files

[PATCH 0/2] liveupdate: prevent double management of files

[Pasha Tatashin]

Currently, LUO does not prevent the same file from being
preserved or managed by multiple active sessions simultaneously.
This can lead to conflicts and inconsistent state.

This series introduces a mechanism to prevent double management by:
1. Adding an I_LUO_MANAGED flag to the inode's i_state.
2. Updating the LUO core to set/check this flag during preservation
   and restoration.
3. Adding a selftest to verify that double preservation is correctly
   prevented with -EBUSY.

Background:
Because LUO preserves files of absolutely different types: memfd, and
upcoming vfiofd [1], iommufd [2], guestmefd (and possible kvmfd/cpufd).
There is no common private data or guarantee on how to prevent that the
same file is not preserved twice beside using inode or some slower and
expensive method like hashtables.

[1] https://lore.kernel.org/all/20260129212510.967611-1-dmatlack@google.com
[2] https://lore.kernel.org/all/20260203220948.2176157-1-skhawaja@google.com

v1:
- Rename I_LUO_PRESERVED to I_LUO_MANAGED (Pratyush Yadav)
- Set flag in luo_retrieve_file() and clear in luo_file_finish() (Pratyush Yadav)
- Added trailing comma to enum (Jan Kara)
- Added selftests.
RFC:
https://lore.kernel.org/all/20260317023834.487682-1-pasha.tatashin@soleen.com

Pasha Tatashin (2):
  liveupdate: prevent double management of files
  selftests: liveupdate: add test for double preservation

 include/linux/fs.h                            |  5 ++-
 kernel/liveupdate/luo_file.c                  | 27 ++++++++++--
 .../testing/selftests/liveupdate/liveupdate.c | 41 +++++++++++++++++++
 3 files changed, 69 insertions(+), 4 deletions(-)

-- 
2.43.0

[PATCH 1/2] liveupdate: prevent double management of files

[Pasha Tatashin]

Currently, LUO does not prevent the same file from being managed twice
across different active sessions.

Add a new i_state flag I_LUO_MANAGED and update luo_preserve_file()
to check and set this flag when a file is preserved, and clear it in
luo_file_unpreserve_files() when it is released.

Additionally, set this flag in luo_retrieve_file() after a file is
successfully restored in the new kernel, and clear it in
luo_file_finish() when the LUO session is finalized.

This ensures that the same file (inode) cannot be managed by multiple
sessions. If another session attempts to preserve an already managed
file, it will now fail with -EBUSY.

Acked-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Acked-by: Jan Kara <jack@suse.cz>
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
 include/linux/fs.h           |  5 ++++-
 kernel/liveupdate/luo_file.c | 27 ++++++++++++++++++++++++---
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 23f36a2613a3..692a8be56f3c 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -712,6 +712,8 @@ is_uncached_acl(struct posix_acl *acl)
  * I_LRU_ISOLATING	Inode is pinned being isolated from LRU without holding
  *			i_count.
  *
+ * I_LUO_MANAGED	Inode is being managed by a live update session.
+ *
  * Q: What is the difference between I_WILL_FREE and I_FREEING?
  *
  * __I_{SYNC,NEW,LRU_ISOLATING} are used to derive unique addresses to wait
@@ -744,7 +746,8 @@ enum inode_state_flags_enum {
 	I_CREATING		= (1U << 15),
 	I_DONTCACHE		= (1U << 16),
 	I_SYNC_QUEUED		= (1U << 17),
-	I_PINNING_NETFS_WB	= (1U << 18)
+	I_PINNING_NETFS_WB	= (1U << 18),
+	I_LUO_MANAGED		= (1U << 19),
 };
 
 #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
index 5acee4174bf0..86911beeff71 100644
--- a/kernel/liveupdate/luo_file.c
+++ b/kernel/liveupdate/luo_file.c
@@ -248,6 +248,7 @@ static bool luo_token_is_used(struct luo_file_set *file_set, u64 token)
  * Context: Can be called from an ioctl handler during normal system operation.
  * Return: 0 on success. Returns a negative errno on failure:
  *         -EEXIST if the token is already used.
+ *         -EBUSY if the file descriptor is already preserved by another session.
  *         -EBADF if the file descriptor is invalid.
  *         -ENOSPC if the file_set is full.
  *         -ENOENT if no compatible handler is found.
@@ -276,6 +277,14 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
 	if (err)
 		goto  err_fput;
 
+	scoped_guard(spinlock, &file_inode(file)->i_lock) {
+		if (inode_state_read(file_inode(file)) & I_LUO_MANAGED) {
+			err = -EBUSY;
+			goto err_free_files_mem;
+		}
+		inode_state_set(file_inode(file), I_LUO_MANAGED);
+	}
+
 	err = -ENOENT;
 	list_private_for_each_entry(fh, &luo_file_handler_list, list) {
 		if (fh->ops->can_preserve(fh, file)) {
@@ -286,11 +295,11 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
 
 	/* err is still -ENOENT if no handler was found */
 	if (err)
-		goto err_free_files_mem;
+		goto err_unpreserve_inode;
 
 	err = luo_flb_file_preserve(fh);
 	if (err)
-		goto err_free_files_mem;
+		goto err_unpreserve_inode;
 
 	luo_file = kzalloc_obj(*luo_file);
 	if (!luo_file) {
@@ -320,6 +329,9 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
 	kfree(luo_file);
 err_flb_unpreserve:
 	luo_flb_file_unpreserve(fh);
+err_unpreserve_inode:
+	scoped_guard(spinlock, &file_inode(file)->i_lock)
+		inode_state_clear(file_inode(file), I_LUO_MANAGED);
 err_free_files_mem:
 	luo_free_files_mem(file_set);
 err_fput:
@@ -363,6 +375,9 @@ void luo_file_unpreserve_files(struct luo_file_set *file_set)
 		luo_file->fh->ops->unpreserve(&args);
 		luo_flb_file_unpreserve(luo_file->fh);
 
+		scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
+			inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
+
 		list_del(&luo_file->list);
 		file_set->count--;
 
@@ -609,6 +624,9 @@ int luo_retrieve_file(struct luo_file_set *file_set, u64 token,
 	*filep = luo_file->file;
 	luo_file->retrieve_status = 1;
 
+	scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
+		inode_state_set(file_inode(luo_file->file), I_LUO_MANAGED);
+
 	return 0;
 }
 
@@ -701,8 +719,11 @@ int luo_file_finish(struct luo_file_set *file_set)
 
 		luo_file_finish_one(file_set, luo_file);
 
-		if (luo_file->file)
+		if (luo_file->file) {
+			scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
+				inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
 			fput(luo_file->file);
+		}
 		list_del(&luo_file->list);
 		file_set->count--;
 		mutex_destroy(&luo_file->mutex);
-- 
2.43.0

Re: [PATCH 1/2] liveupdate: prevent double management of files

[Pasha Tatashin]

On Sat, Mar 21, 2026 at 1:58 PM Pasha Tatashin
<pasha.tatashin@soleen.com> wrote:
>
> Currently, LUO does not prevent the same file from being managed twice
> across different active sessions.
>
> Add a new i_state flag I_LUO_MANAGED and update luo_preserve_file()
> to check and set this flag when a file is preserved, and clear it in
> luo_file_unpreserve_files() when it is released.
>
> Additionally, set this flag in luo_retrieve_file() after a file is
> successfully restored in the new kernel, and clear it in
> luo_file_finish() when the LUO session is finalized.
>
> This ensures that the same file (inode) cannot be managed by multiple
> sessions. If another session attempts to preserve an already managed
> file, it will now fail with -EBUSY.
>
> Acked-by: Pratyush Yadav (Google) <pratyush@kernel.org>
> Acked-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> ---
>  include/linux/fs.h           |  5 ++++-
>  kernel/liveupdate/luo_file.c | 27 ++++++++++++++++++++++++---
>  2 files changed, 28 insertions(+), 4 deletions(-)
>
> diff --git a/include/linux/fs.h b/include/linux/fs.h
> index 23f36a2613a3..692a8be56f3c 100644
> --- a/include/linux/fs.h
> +++ b/include/linux/fs.h
> @@ -712,6 +712,8 @@ is_uncached_acl(struct posix_acl *acl)
>   * I_LRU_ISOLATING     Inode is pinned being isolated from LRU without holding
>   *                     i_count.
>   *
> + * I_LUO_MANAGED       Inode is being managed by a live update session.
> + *
>   * Q: What is the difference between I_WILL_FREE and I_FREEING?
>   *
>   * __I_{SYNC,NEW,LRU_ISOLATING} are used to derive unique addresses to wait
> @@ -744,7 +746,8 @@ enum inode_state_flags_enum {
>         I_CREATING              = (1U << 15),
>         I_DONTCACHE             = (1U << 16),
>         I_SYNC_QUEUED           = (1U << 17),
> -       I_PINNING_NETFS_WB      = (1U << 18)
> +       I_PINNING_NETFS_WB      = (1U << 18),
> +       I_LUO_MANAGED           = (1U << 19),
>  };
>
>  #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
> diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
> index 5acee4174bf0..86911beeff71 100644
> --- a/kernel/liveupdate/luo_file.c
> +++ b/kernel/liveupdate/luo_file.c
> @@ -248,6 +248,7 @@ static bool luo_token_is_used(struct luo_file_set *file_set, u64 token)
>   * Context: Can be called from an ioctl handler during normal system operation.
>   * Return: 0 on success. Returns a negative errno on failure:
>   *         -EEXIST if the token is already used.
> + *         -EBUSY if the file descriptor is already preserved by another session.
>   *         -EBADF if the file descriptor is invalid.
>   *         -ENOSPC if the file_set is full.
>   *         -ENOENT if no compatible handler is found.
> @@ -276,6 +277,14 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
>         if (err)
>                 goto  err_fput;
>
> +       scoped_guard(spinlock, &file_inode(file)->i_lock) {
> +               if (inode_state_read(file_inode(file)) & I_LUO_MANAGED) {
> +                       err = -EBUSY;
> +                       goto err_free_files_mem;
> +               }
> +               inode_state_set(file_inode(file), I_LUO_MANAGED);
> +       }
> +
>         err = -ENOENT;
>         list_private_for_each_entry(fh, &luo_file_handler_list, list) {
>                 if (fh->ops->can_preserve(fh, file)) {
> @@ -286,11 +295,11 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
>
>         /* err is still -ENOENT if no handler was found */
>         if (err)
> -               goto err_free_files_mem;
> +               goto err_unpreserve_inode;
>
>         err = luo_flb_file_preserve(fh);
>         if (err)
> -               goto err_free_files_mem;
> +               goto err_unpreserve_inode;
>
>         luo_file = kzalloc_obj(*luo_file);
>         if (!luo_file) {
> @@ -320,6 +329,9 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
>         kfree(luo_file);
>  err_flb_unpreserve:
>         luo_flb_file_unpreserve(fh);
> +err_unpreserve_inode:
> +       scoped_guard(spinlock, &file_inode(file)->i_lock)
> +               inode_state_clear(file_inode(file), I_LUO_MANAGED);
>  err_free_files_mem:
>         luo_free_files_mem(file_set);
>  err_fput:
> @@ -363,6 +375,9 @@ void luo_file_unpreserve_files(struct luo_file_set *file_set)
>                 luo_file->fh->ops->unpreserve(&args);
>                 luo_flb_file_unpreserve(luo_file->fh);
>
> +               scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> +                       inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
> +
>                 list_del(&luo_file->list);
>                 file_set->count--;
>
> @@ -609,6 +624,9 @@ int luo_retrieve_file(struct luo_file_set *file_set, u64 token,
>         *filep = luo_file->file;
>         luo_file->retrieve_status = 1;
>
> +       scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> +               inode_state_set(file_inode(luo_file->file), I_LUO_MANAGED);
> +
>         return 0;
>  }
>
> @@ -701,8 +719,11 @@ int luo_file_finish(struct luo_file_set *file_set)
>
>                 luo_file_finish_one(file_set, luo_file);
>
> -               if (luo_file->file)
> +               if (luo_file->file) {
> +                       scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> +                               inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
>                         fput(luo_file->file);
> +               }
>                 list_del(&luo_file->list);
>                 file_set->count--;
>                 mutex_destroy(&luo_file->mutex);
> --
> 2.43.0
>

> Sashiko: https://sashiko.dev/#/patchset/20260321175808.57942-1-pasha.tatashin@soleen.com

Sashiko reported two problems:

1. Are there any issues with mixing goto-based error handling and scope-based
cleanups like scoped_guard() in the same function?

Initially, I thought that there should not be any problems, however,
after looking this up  I found in include/linux/cleanup.h the
following comment:

 * Lastly, given that the benefit of cleanup helpers is removal of
 * "goto", and that the "goto" statement can jump between scopes, the
 * expectation is that usage of "goto" and cleanup helpers is never
 * mixed in the same function.

Well, good to know, will not use goto inside scoped_guards.

2. Additionally, does setting I_LUO_MANAGED on the inode break the preservation
of anonymous inodes? Many file types (like eventfd, epoll, timerfd,
signalfd)

This is actually a very good point. It looks like everyone who uses
anon_inode_getfd() has one shared inode. This is not a problem for the
existing LUO user memfd, or for the upcoming vfiofd and memfd, but
kvm-vmfd and kvm-cpufd also use it, and that might be a problem in the
future once we add support for Orphaned VMs.

Therefore, we have two choices: either use a hash table, which adds
performance and memory overhead, or delegate this double-check to the
LUO file handlers, as they can use a private context to know if the FD
is already preserved.

Pasha

Re: [PATCH 1/2] liveupdate: prevent double management of files

[Christian Brauner]

On Sat, Mar 21, 2026 at 09:04:53PM -0400, Pasha Tatashin wrote:
> On Sat, Mar 21, 2026 at 1:58 PM Pasha Tatashin
> <pasha.tatashin@soleen.com> wrote:
> >
> > Currently, LUO does not prevent the same file from being managed twice
> > across different active sessions.
> >
> > Add a new i_state flag I_LUO_MANAGED and update luo_preserve_file()
> > to check and set this flag when a file is preserved, and clear it in
> > luo_file_unpreserve_files() when it is released.
> >
> > Additionally, set this flag in luo_retrieve_file() after a file is
> > successfully restored in the new kernel, and clear it in
> > luo_file_finish() when the LUO session is finalized.
> >
> > This ensures that the same file (inode) cannot be managed by multiple
> > sessions. If another session attempts to preserve an already managed
> > file, it will now fail with -EBUSY.
> >
> > Acked-by: Pratyush Yadav (Google) <pratyush@kernel.org>
> > Acked-by: Jan Kara <jack@suse.cz>
> > Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> > ---
> >  include/linux/fs.h           |  5 ++++-
> >  kernel/liveupdate/luo_file.c | 27 ++++++++++++++++++++++++---
> >  2 files changed, 28 insertions(+), 4 deletions(-)
> >
> > diff --git a/include/linux/fs.h b/include/linux/fs.h
> > index 23f36a2613a3..692a8be56f3c 100644
> > --- a/include/linux/fs.h
> > +++ b/include/linux/fs.h
> > @@ -712,6 +712,8 @@ is_uncached_acl(struct posix_acl *acl)
> >   * I_LRU_ISOLATING     Inode is pinned being isolated from LRU without holding
> >   *                     i_count.
> >   *
> > + * I_LUO_MANAGED       Inode is being managed by a live update session.
> > + *
> >   * Q: What is the difference between I_WILL_FREE and I_FREEING?
> >   *
> >   * __I_{SYNC,NEW,LRU_ISOLATING} are used to derive unique addresses to wait
> > @@ -744,7 +746,8 @@ enum inode_state_flags_enum {
> >         I_CREATING              = (1U << 15),
> >         I_DONTCACHE             = (1U << 16),
> >         I_SYNC_QUEUED           = (1U << 17),
> > -       I_PINNING_NETFS_WB      = (1U << 18)
> > +       I_PINNING_NETFS_WB      = (1U << 18),
> > +       I_LUO_MANAGED           = (1U << 19),
> >  };
> >
> >  #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
> > diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
> > index 5acee4174bf0..86911beeff71 100644
> > --- a/kernel/liveupdate/luo_file.c
> > +++ b/kernel/liveupdate/luo_file.c
> > @@ -248,6 +248,7 @@ static bool luo_token_is_used(struct luo_file_set *file_set, u64 token)
> >   * Context: Can be called from an ioctl handler during normal system operation.
> >   * Return: 0 on success. Returns a negative errno on failure:
> >   *         -EEXIST if the token is already used.
> > + *         -EBUSY if the file descriptor is already preserved by another session.
> >   *         -EBADF if the file descriptor is invalid.
> >   *         -ENOSPC if the file_set is full.
> >   *         -ENOENT if no compatible handler is found.
> > @@ -276,6 +277,14 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
> >         if (err)
> >                 goto  err_fput;
> >
> > +       scoped_guard(spinlock, &file_inode(file)->i_lock) {
> > +               if (inode_state_read(file_inode(file)) & I_LUO_MANAGED) {
> > +                       err = -EBUSY;
> > +                       goto err_free_files_mem;
> > +               }
> > +               inode_state_set(file_inode(file), I_LUO_MANAGED);
> > +       }
> > +
> >         err = -ENOENT;
> >         list_private_for_each_entry(fh, &luo_file_handler_list, list) {
> >                 if (fh->ops->can_preserve(fh, file)) {
> > @@ -286,11 +295,11 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
> >
> >         /* err is still -ENOENT if no handler was found */
> >         if (err)
> > -               goto err_free_files_mem;
> > +               goto err_unpreserve_inode;
> >
> >         err = luo_flb_file_preserve(fh);
> >         if (err)
> > -               goto err_free_files_mem;
> > +               goto err_unpreserve_inode;
> >
> >         luo_file = kzalloc_obj(*luo_file);
> >         if (!luo_file) {
> > @@ -320,6 +329,9 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
> >         kfree(luo_file);
> >  err_flb_unpreserve:
> >         luo_flb_file_unpreserve(fh);
> > +err_unpreserve_inode:
> > +       scoped_guard(spinlock, &file_inode(file)->i_lock)
> > +               inode_state_clear(file_inode(file), I_LUO_MANAGED);
> >  err_free_files_mem:
> >         luo_free_files_mem(file_set);
> >  err_fput:
> > @@ -363,6 +375,9 @@ void luo_file_unpreserve_files(struct luo_file_set *file_set)
> >                 luo_file->fh->ops->unpreserve(&args);
> >                 luo_flb_file_unpreserve(luo_file->fh);
> >
> > +               scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> > +                       inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
> > +
> >                 list_del(&luo_file->list);
> >                 file_set->count--;
> >
> > @@ -609,6 +624,9 @@ int luo_retrieve_file(struct luo_file_set *file_set, u64 token,
> >         *filep = luo_file->file;
> >         luo_file->retrieve_status = 1;
> >
> > +       scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> > +               inode_state_set(file_inode(luo_file->file), I_LUO_MANAGED);
> > +
> >         return 0;
> >  }
> >
> > @@ -701,8 +719,11 @@ int luo_file_finish(struct luo_file_set *file_set)
> >
> >                 luo_file_finish_one(file_set, luo_file);
> >
> > -               if (luo_file->file)
> > +               if (luo_file->file) {
> > +                       scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> > +                               inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
> >                         fput(luo_file->file);
> > +               }
> >                 list_del(&luo_file->list);
> >                 file_set->count--;
> >                 mutex_destroy(&luo_file->mutex);
> > --
> > 2.43.0
> >
> 
> > Sashiko: https://sashiko.dev/#/patchset/20260321175808.57942-1-pasha.tatashin@soleen.com
> 
> Sashiko reported two problems:
> 
> 1. Are there any issues with mixing goto-based error handling and scope-based
> cleanups like scoped_guard() in the same function?
> 
> Initially, I thought that there should not be any problems, however,
> after looking this up  I found in include/linux/cleanup.h the
> following comment:
> 
>  * Lastly, given that the benefit of cleanup helpers is removal of
>  * "goto", and that the "goto" statement can jump between scopes, the
>  * expectation is that usage of "goto" and cleanup helpers is never
>  * mixed in the same function.

There's a compile-time switch you might want to turn on when
test-compiling code like this. I forget exactly what it is. Something
like jump-over-uninit or something.

> 
> Well, good to know, will not use goto inside scoped_guards.
> 
> 2. Additionally, does setting I_LUO_MANAGED on the inode break the preservation
> of anonymous inodes? Many file types (like eventfd, epoll, timerfd,
> signalfd)
> 
> This is actually a very good point. It looks like everyone who uses
> anon_inode_getfd() has one shared inode. This is not a problem for the
> existing LUO user memfd, or for the upcoming vfiofd and memfd, but
> kvm-vmfd and kvm-cpufd also use it, and that might be a problem in the
> future once we add support for Orphaned VMs.
> 
> Therefore, we have two choices: either use a hash table, which adds
> performance and memory overhead, or delegate this double-check to the
> LUO file handlers, as they can use a private context to know if the FD
> is already preserved.

So, I'm not happy about I_LUO_MANAGED. I don't think we need driver
specific stuff in struct inode and not in i_state. Track this in the
driver please. I don't want this precedent and I'd rather have you get
used to implementing such things in the driver right away rather than
offloading this on general infrastructure. If we let this slide struct
inode will be 2MB 1 in year.

Re: [PATCH 1/2] liveupdate: prevent double management of files

[Pasha Tatashin]

On Mon, Mar 23, 2026 at 7:55 AM Christian Brauner <brauner@kernel.org> wrote:
>
> On Sat, Mar 21, 2026 at 09:04:53PM -0400, Pasha Tatashin wrote:
> > On Sat, Mar 21, 2026 at 1:58 PM Pasha Tatashin
> > <pasha.tatashin@soleen.com> wrote:
> > >
> > > Currently, LUO does not prevent the same file from being managed twice
> > > across different active sessions.
> > >
> > > Add a new i_state flag I_LUO_MANAGED and update luo_preserve_file()
> > > to check and set this flag when a file is preserved, and clear it in
> > > luo_file_unpreserve_files() when it is released.
> > >
> > > Additionally, set this flag in luo_retrieve_file() after a file is
> > > successfully restored in the new kernel, and clear it in
> > > luo_file_finish() when the LUO session is finalized.
> > >
> > > This ensures that the same file (inode) cannot be managed by multiple
> > > sessions. If another session attempts to preserve an already managed
> > > file, it will now fail with -EBUSY.
> > >
> > > Acked-by: Pratyush Yadav (Google) <pratyush@kernel.org>
> > > Acked-by: Jan Kara <jack@suse.cz>
> > > Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> > > ---
> > >  include/linux/fs.h           |  5 ++++-
> > >  kernel/liveupdate/luo_file.c | 27 ++++++++++++++++++++++++---
> > >  2 files changed, 28 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/include/linux/fs.h b/include/linux/fs.h
> > > index 23f36a2613a3..692a8be56f3c 100644
> > > --- a/include/linux/fs.h
> > > +++ b/include/linux/fs.h
> > > @@ -712,6 +712,8 @@ is_uncached_acl(struct posix_acl *acl)
> > >   * I_LRU_ISOLATING     Inode is pinned being isolated from LRU without holding
> > >   *                     i_count.
> > >   *
> > > + * I_LUO_MANAGED       Inode is being managed by a live update session.
> > > + *
> > >   * Q: What is the difference between I_WILL_FREE and I_FREEING?
> > >   *
> > >   * __I_{SYNC,NEW,LRU_ISOLATING} are used to derive unique addresses to wait
> > > @@ -744,7 +746,8 @@ enum inode_state_flags_enum {
> > >         I_CREATING              = (1U << 15),
> > >         I_DONTCACHE             = (1U << 16),
> > >         I_SYNC_QUEUED           = (1U << 17),
> > > -       I_PINNING_NETFS_WB      = (1U << 18)
> > > +       I_PINNING_NETFS_WB      = (1U << 18),
> > > +       I_LUO_MANAGED           = (1U << 19),
> > >  };
> > >
> > >  #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
> > > diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
> > > index 5acee4174bf0..86911beeff71 100644
> > > --- a/kernel/liveupdate/luo_file.c
> > > +++ b/kernel/liveupdate/luo_file.c
> > > @@ -248,6 +248,7 @@ static bool luo_token_is_used(struct luo_file_set *file_set, u64 token)
> > >   * Context: Can be called from an ioctl handler during normal system operation.
> > >   * Return: 0 on success. Returns a negative errno on failure:
> > >   *         -EEXIST if the token is already used.
> > > + *         -EBUSY if the file descriptor is already preserved by another session.
> > >   *         -EBADF if the file descriptor is invalid.
> > >   *         -ENOSPC if the file_set is full.
> > >   *         -ENOENT if no compatible handler is found.
> > > @@ -276,6 +277,14 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
> > >         if (err)
> > >                 goto  err_fput;
> > >
> > > +       scoped_guard(spinlock, &file_inode(file)->i_lock) {
> > > +               if (inode_state_read(file_inode(file)) & I_LUO_MANAGED) {
> > > +                       err = -EBUSY;
> > > +                       goto err_free_files_mem;
> > > +               }
> > > +               inode_state_set(file_inode(file), I_LUO_MANAGED);
> > > +       }
> > > +
> > >         err = -ENOENT;
> > >         list_private_for_each_entry(fh, &luo_file_handler_list, list) {
> > >                 if (fh->ops->can_preserve(fh, file)) {
> > > @@ -286,11 +295,11 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
> > >
> > >         /* err is still -ENOENT if no handler was found */
> > >         if (err)
> > > -               goto err_free_files_mem;
> > > +               goto err_unpreserve_inode;
> > >
> > >         err = luo_flb_file_preserve(fh);
> > >         if (err)
> > > -               goto err_free_files_mem;
> > > +               goto err_unpreserve_inode;
> > >
> > >         luo_file = kzalloc_obj(*luo_file);
> > >         if (!luo_file) {
> > > @@ -320,6 +329,9 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
> > >         kfree(luo_file);
> > >  err_flb_unpreserve:
> > >         luo_flb_file_unpreserve(fh);
> > > +err_unpreserve_inode:
> > > +       scoped_guard(spinlock, &file_inode(file)->i_lock)
> > > +               inode_state_clear(file_inode(file), I_LUO_MANAGED);
> > >  err_free_files_mem:
> > >         luo_free_files_mem(file_set);
> > >  err_fput:
> > > @@ -363,6 +375,9 @@ void luo_file_unpreserve_files(struct luo_file_set *file_set)
> > >                 luo_file->fh->ops->unpreserve(&args);
> > >                 luo_flb_file_unpreserve(luo_file->fh);
> > >
> > > +               scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> > > +                       inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
> > > +
> > >                 list_del(&luo_file->list);
> > >                 file_set->count--;
> > >
> > > @@ -609,6 +624,9 @@ int luo_retrieve_file(struct luo_file_set *file_set, u64 token,
> > >         *filep = luo_file->file;
> > >         luo_file->retrieve_status = 1;
> > >
> > > +       scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> > > +               inode_state_set(file_inode(luo_file->file), I_LUO_MANAGED);
> > > +
> > >         return 0;
> > >  }
> > >
> > > @@ -701,8 +719,11 @@ int luo_file_finish(struct luo_file_set *file_set)
> > >
> > >                 luo_file_finish_one(file_set, luo_file);
> > >
> > > -               if (luo_file->file)
> > > +               if (luo_file->file) {
> > > +                       scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> > > +                               inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
> > >                         fput(luo_file->file);
> > > +               }
> > >                 list_del(&luo_file->list);
> > >                 file_set->count--;
> > >                 mutex_destroy(&luo_file->mutex);
> > > --
> > > 2.43.0
> > >
> >
> > > Sashiko: https://sashiko.dev/#/patchset/20260321175808.57942-1-pasha.tatashin@soleen.com
> >
> > Sashiko reported two problems:
> >
> > 1. Are there any issues with mixing goto-based error handling and scope-based
> > cleanups like scoped_guard() in the same function?
> >
> > Initially, I thought that there should not be any problems, however,
> > after looking this up  I found in include/linux/cleanup.h the
> > following comment:
> >
> >  * Lastly, given that the benefit of cleanup helpers is removal of
> >  * "goto", and that the "goto" statement can jump between scopes, the
> >  * expectation is that usage of "goto" and cleanup helpers is never
> >  * mixed in the same function.
>
> There's a compile-time switch you might want to turn on when
> test-compiling code like this. I forget exactly what it is. Something
> like jump-over-uninit or something.
>
> >
> > Well, good to know, will not use goto inside scoped_guards.
> >
> > 2. Additionally, does setting I_LUO_MANAGED on the inode break the preservation
> > of anonymous inodes? Many file types (like eventfd, epoll, timerfd,
> > signalfd)
> >
> > This is actually a very good point. It looks like everyone who uses
> > anon_inode_getfd() has one shared inode. This is not a problem for the
> > existing LUO user memfd, or for the upcoming vfiofd and memfd, but
> > kvm-vmfd and kvm-cpufd also use it, and that might be a problem in the
> > future once we add support for Orphaned VMs.
> >
> > Therefore, we have two choices: either use a hash table, which adds
> > performance and memory overhead, or delegate this double-check to the
> > LUO file handlers, as they can use a private context to know if the FD
> > is already preserved.
>
> So, I'm not happy about I_LUO_MANAGED. I don't think we need driver
> specific stuff in struct inode and not in i_state. Track this in the
> driver please. I don't want this precedent and I'd rather have you get

I am planning to use an xarray in the next version.

> used to implementing such things in the driver right away rather than
> offloading this on general infrastructure. If we let this slide struct
> inode will be 2MB 1 in year.

Claiming that a single flag bit precedent would cause the overall
struct to grow by 2MB in a year is a slight exaggeration. :-)

Pasha

Re: [PATCH 1/2] liveupdate: prevent double management of files

[Christian Brauner]

On Mon, Mar 23, 2026 at 09:18:03AM -0400, Pasha Tatashin wrote:
> On Mon, Mar 23, 2026 at 7:55 AM Christian Brauner <brauner@kernel.org> wrote:
> >
> > On Sat, Mar 21, 2026 at 09:04:53PM -0400, Pasha Tatashin wrote:
> > > On Sat, Mar 21, 2026 at 1:58 PM Pasha Tatashin
> > > <pasha.tatashin@soleen.com> wrote:
> > > >
> > > > Currently, LUO does not prevent the same file from being managed twice
> > > > across different active sessions.
> > > >
> > > > Add a new i_state flag I_LUO_MANAGED and update luo_preserve_file()
> > > > to check and set this flag when a file is preserved, and clear it in
> > > > luo_file_unpreserve_files() when it is released.
> > > >
> > > > Additionally, set this flag in luo_retrieve_file() after a file is
> > > > successfully restored in the new kernel, and clear it in
> > > > luo_file_finish() when the LUO session is finalized.
> > > >
> > > > This ensures that the same file (inode) cannot be managed by multiple
> > > > sessions. If another session attempts to preserve an already managed
> > > > file, it will now fail with -EBUSY.
> > > >
> > > > Acked-by: Pratyush Yadav (Google) <pratyush@kernel.org>
> > > > Acked-by: Jan Kara <jack@suse.cz>
> > > > Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> > > > ---
> > > >  include/linux/fs.h           |  5 ++++-
> > > >  kernel/liveupdate/luo_file.c | 27 ++++++++++++++++++++++++---
> > > >  2 files changed, 28 insertions(+), 4 deletions(-)
> > > >
> > > > diff --git a/include/linux/fs.h b/include/linux/fs.h
> > > > index 23f36a2613a3..692a8be56f3c 100644
> > > > --- a/include/linux/fs.h
> > > > +++ b/include/linux/fs.h
> > > > @@ -712,6 +712,8 @@ is_uncached_acl(struct posix_acl *acl)
> > > >   * I_LRU_ISOLATING     Inode is pinned being isolated from LRU without holding
> > > >   *                     i_count.
> > > >   *
> > > > + * I_LUO_MANAGED       Inode is being managed by a live update session.
> > > > + *
> > > >   * Q: What is the difference between I_WILL_FREE and I_FREEING?
> > > >   *
> > > >   * __I_{SYNC,NEW,LRU_ISOLATING} are used to derive unique addresses to wait
> > > > @@ -744,7 +746,8 @@ enum inode_state_flags_enum {
> > > >         I_CREATING              = (1U << 15),
> > > >         I_DONTCACHE             = (1U << 16),
> > > >         I_SYNC_QUEUED           = (1U << 17),
> > > > -       I_PINNING_NETFS_WB      = (1U << 18)
> > > > +       I_PINNING_NETFS_WB      = (1U << 18),
> > > > +       I_LUO_MANAGED           = (1U << 19),
> > > >  };
> > > >
> > > >  #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
> > > > diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
> > > > index 5acee4174bf0..86911beeff71 100644
> > > > --- a/kernel/liveupdate/luo_file.c
> > > > +++ b/kernel/liveupdate/luo_file.c
> > > > @@ -248,6 +248,7 @@ static bool luo_token_is_used(struct luo_file_set *file_set, u64 token)
> > > >   * Context: Can be called from an ioctl handler during normal system operation.
> > > >   * Return: 0 on success. Returns a negative errno on failure:
> > > >   *         -EEXIST if the token is already used.
> > > > + *         -EBUSY if the file descriptor is already preserved by another session.
> > > >   *         -EBADF if the file descriptor is invalid.
> > > >   *         -ENOSPC if the file_set is full.
> > > >   *         -ENOENT if no compatible handler is found.
> > > > @@ -276,6 +277,14 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
> > > >         if (err)
> > > >                 goto  err_fput;
> > > >
> > > > +       scoped_guard(spinlock, &file_inode(file)->i_lock) {
> > > > +               if (inode_state_read(file_inode(file)) & I_LUO_MANAGED) {
> > > > +                       err = -EBUSY;
> > > > +                       goto err_free_files_mem;
> > > > +               }
> > > > +               inode_state_set(file_inode(file), I_LUO_MANAGED);
> > > > +       }
> > > > +
> > > >         err = -ENOENT;
> > > >         list_private_for_each_entry(fh, &luo_file_handler_list, list) {
> > > >                 if (fh->ops->can_preserve(fh, file)) {
> > > > @@ -286,11 +295,11 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
> > > >
> > > >         /* err is still -ENOENT if no handler was found */
> > > >         if (err)
> > > > -               goto err_free_files_mem;
> > > > +               goto err_unpreserve_inode;
> > > >
> > > >         err = luo_flb_file_preserve(fh);
> > > >         if (err)
> > > > -               goto err_free_files_mem;
> > > > +               goto err_unpreserve_inode;
> > > >
> > > >         luo_file = kzalloc_obj(*luo_file);
> > > >         if (!luo_file) {
> > > > @@ -320,6 +329,9 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
> > > >         kfree(luo_file);
> > > >  err_flb_unpreserve:
> > > >         luo_flb_file_unpreserve(fh);
> > > > +err_unpreserve_inode:
> > > > +       scoped_guard(spinlock, &file_inode(file)->i_lock)
> > > > +               inode_state_clear(file_inode(file), I_LUO_MANAGED);
> > > >  err_free_files_mem:
> > > >         luo_free_files_mem(file_set);
> > > >  err_fput:
> > > > @@ -363,6 +375,9 @@ void luo_file_unpreserve_files(struct luo_file_set *file_set)
> > > >                 luo_file->fh->ops->unpreserve(&args);
> > > >                 luo_flb_file_unpreserve(luo_file->fh);
> > > >
> > > > +               scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> > > > +                       inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
> > > > +
> > > >                 list_del(&luo_file->list);
> > > >                 file_set->count--;
> > > >
> > > > @@ -609,6 +624,9 @@ int luo_retrieve_file(struct luo_file_set *file_set, u64 token,
> > > >         *filep = luo_file->file;
> > > >         luo_file->retrieve_status = 1;
> > > >
> > > > +       scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> > > > +               inode_state_set(file_inode(luo_file->file), I_LUO_MANAGED);
> > > > +
> > > >         return 0;
> > > >  }
> > > >
> > > > @@ -701,8 +719,11 @@ int luo_file_finish(struct luo_file_set *file_set)
> > > >
> > > >                 luo_file_finish_one(file_set, luo_file);
> > > >
> > > > -               if (luo_file->file)
> > > > +               if (luo_file->file) {
> > > > +                       scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
> > > > +                               inode_state_clear(file_inode(luo_file->file), I_LUO_MANAGED);
> > > >                         fput(luo_file->file);
> > > > +               }
> > > >                 list_del(&luo_file->list);
> > > >                 file_set->count--;
> > > >                 mutex_destroy(&luo_file->mutex);
> > > > --
> > > > 2.43.0
> > > >
> > >
> > > > Sashiko: https://sashiko.dev/#/patchset/20260321175808.57942-1-pasha.tatashin@soleen.com
> > >
> > > Sashiko reported two problems:
> > >
> > > 1. Are there any issues with mixing goto-based error handling and scope-based
> > > cleanups like scoped_guard() in the same function?
> > >
> > > Initially, I thought that there should not be any problems, however,
> > > after looking this up  I found in include/linux/cleanup.h the
> > > following comment:
> > >
> > >  * Lastly, given that the benefit of cleanup helpers is removal of
> > >  * "goto", and that the "goto" statement can jump between scopes, the
> > >  * expectation is that usage of "goto" and cleanup helpers is never
> > >  * mixed in the same function.
> >
> > There's a compile-time switch you might want to turn on when
> > test-compiling code like this. I forget exactly what it is. Something
> > like jump-over-uninit or something.
> >
> > >
> > > Well, good to know, will not use goto inside scoped_guards.
> > >
> > > 2. Additionally, does setting I_LUO_MANAGED on the inode break the preservation
> > > of anonymous inodes? Many file types (like eventfd, epoll, timerfd,
> > > signalfd)
> > >
> > > This is actually a very good point. It looks like everyone who uses
> > > anon_inode_getfd() has one shared inode. This is not a problem for the
> > > existing LUO user memfd, or for the upcoming vfiofd and memfd, but
> > > kvm-vmfd and kvm-cpufd also use it, and that might be a problem in the
> > > future once we add support for Orphaned VMs.
> > >
> > > Therefore, we have two choices: either use a hash table, which adds
> > > performance and memory overhead, or delegate this double-check to the
> > > LUO file handlers, as they can use a private context to know if the FD
> > > is already preserved.
> >
> > So, I'm not happy about I_LUO_MANAGED. I don't think we need driver
> > specific stuff in struct inode and not in i_state. Track this in the
> > driver please. I don't want this precedent and I'd rather have you get
> 
> I am planning to use an xarray in the next version.
> 
> > used to implementing such things in the driver right away rather than
> > offloading this on general infrastructure. If we let this slide struct
> > inode will be 2MB 1 in year.
> 
> Claiming that a single flag bit precedent would cause the overall
> struct to grow by 2MB in a year is a slight exaggeration. :-)

Hm, you say that. But then you don't get ~5-10 patches a year that "just
add a new member into struct inode with 4-8 bytes"... I'm just making an
exaggerated point ofc. :)

But struct inode is used everywhere and I want it contained and small
and whatever lands in it - even flags - better be VFS generic stuff.

We sometimes do carve out exceptions for _filesystem drivers_ where no
other way is possible ofc. But I don't think this should extend to
drivers/.

Re: [PATCH 1/2] liveupdate: prevent double management of files

[Andrew Morton]

On Tue, 24 Mar 2026 09:51:34 +0100 Christian Brauner <brauner@kernel.org> wrote:

> > > So, I'm not happy about I_LUO_MANAGED. I don't think we need driver
> > > specific stuff in struct inode and not in i_state. Track this in the
> > > driver please. I don't want this precedent and I'd rather have you get

Well dang, I just merged v2 but Christian wasn't cc'ed.

> > I am planning to use an xarray in the next version.

That's what v2 did, and I_LUO_MANAGED has gone away.

Christian, does v2 look OK?  It's at
https://lkml.kernel.org/r/20260323203145.148057-1-pasha.tatashin@soleen.com

Re: [PATCH 1/2] liveupdate: prevent double management of files

[Pasha Tatashin]

On Tue, Mar 24, 2026 at 2:40 PM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Tue, 24 Mar 2026 09:51:34 +0100 Christian Brauner <brauner@kernel.org> wrote:
>
> > > > So, I'm not happy about I_LUO_MANAGED. I don't think we need driver
> > > > specific stuff in struct inode and not in i_state. Track this in the
> > > > driver please. I don't want this precedent and I'd rather have you get
>
> Well dang, I just merged v2 but Christian wasn't cc'ed.
>
> > > I am planning to use an xarray in the next version.
>
> That's what v2 did, and I_LUO_MANAGED has gone away.
>
> Christian, does v2 look OK?  It's at
> https://lkml.kernel.org/r/20260323203145.148057-1-pasha.tatashin@soleen.com

Yes, v2 is fine. Here, we discussed about the previous approach, this
is one of the reason why v2 exists: not to modify inode, and also not
to rely on inode being different for every preserved file.

Thanks,
Pasha

>
>

[PATCH 2/2] selftests: liveupdate: add test for double preservation

[Pasha Tatashin]

Verify that a file can only be preserved once across all active
sessions. Attempting to preserve it a second time, whether in the same
or a different session, should fail with EBUSY.

Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---
 .../testing/selftests/liveupdate/liveupdate.c | 41 +++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/tools/testing/selftests/liveupdate/liveupdate.c b/tools/testing/selftests/liveupdate/liveupdate.c
index c2878e3d5ef9..37c808fbe1e9 100644
--- a/tools/testing/selftests/liveupdate/liveupdate.c
+++ b/tools/testing/selftests/liveupdate/liveupdate.c
@@ -345,4 +345,45 @@ TEST_F(liveupdate_device, preserve_unsupported_fd)
 	ASSERT_EQ(close(session_fd), 0);
 }
 
+/*
+ * Test Case: Prevent Double Preservation
+ *
+ * Verifies that a file (memfd) can only be preserved once across all active
+ * sessions. Attempting to preserve it a second time, whether in the same or
+ * a different session, should fail with EBUSY.
+ */
+TEST_F(liveupdate_device, prevent_double_preservation)
+{
+	int session_fd1, session_fd2, mem_fd;
+	int ret;
+
+	self->fd1 = open(LIVEUPDATE_DEV, O_RDWR);
+	if (self->fd1 < 0 && errno == ENOENT)
+		SKIP(return, "%s does not exist", LIVEUPDATE_DEV);
+	ASSERT_GE(self->fd1, 0);
+
+	session_fd1 = create_session(self->fd1, "double-preserve-session-1");
+	ASSERT_GE(session_fd1, 0);
+	session_fd2 = create_session(self->fd1, "double-preserve-session-2");
+	ASSERT_GE(session_fd2, 0);
+
+	mem_fd = memfd_create("test-memfd", 0);
+	ASSERT_GE(mem_fd, 0);
+
+	/* First preservation should succeed */
+	ASSERT_EQ(preserve_fd(session_fd1, mem_fd, 0x1111), 0);
+
+	/* Second preservation in a different session should fail with EBUSY */
+	ret = preserve_fd(session_fd2, mem_fd, 0x2222);
+	EXPECT_EQ(ret, -EBUSY);
+
+	/* Second preservation in the same session (different token) should fail with EBUSY */
+	ret = preserve_fd(session_fd1, mem_fd, 0x3333);
+	EXPECT_EQ(ret, -EBUSY);
+
+	ASSERT_EQ(close(mem_fd), 0);
+	ASSERT_EQ(close(session_fd1), 0);
+	ASSERT_EQ(close(session_fd2), 0);
+}
+
 TEST_HARNESS_MAIN
-- 
2.43.0