[RFC] liveupdate: prevent double preservation

[RFC] liveupdate: prevent double preservation

[Pasha Tatashin]

Currently, LUO does not prevent the same file from being preserved twice
across different active sessions.

Add a new i_state flag I_LUO_PRESERVED and update luo_preserve_file()
to check and set this flag when a file is preserved, and clear it in
luo_file_unpreserve_files() when it is released. This ensures that the
same file (inode) cannot be preserved by multiple sessions. If another
session attempts to preserve an already preserved file, it will now
fail with -EBUSY.

Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
---

Background:
Because LUO preserves files of absolutely different types: memfd, and
upcoming  vfiofd [1], iommufd [2], guestmefd (and possible kvmfd/cpufd).
There is no common private data or guarantee on how to prevent that the
same file is not preserved twice beside using inode or some slower and
expensive method like hashtables.

[1] https://lore.kernel.org/all/20260129212510.967611-1-dmatlack@google.com
[2] https://lore.kernel.org/all/20260203220948.2176157-1-skhawaja@google.com

 include/linux/fs.h           |  5 ++++-
 kernel/liveupdate/luo_file.c | 19 +++++++++++++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 23f36a2613a3..029257ee7e0a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -712,6 +712,8 @@ is_uncached_acl(struct posix_acl *acl)
  * I_LRU_ISOLATING	Inode is pinned being isolated from LRU without holding
  *			i_count.
  *
+ * I_LUO_PRESERVED	Inode is being preserved by a live update session.
+ *
  * Q: What is the difference between I_WILL_FREE and I_FREEING?
  *
  * __I_{SYNC,NEW,LRU_ISOLATING} are used to derive unique addresses to wait
@@ -744,7 +746,8 @@ enum inode_state_flags_enum {
 	I_CREATING		= (1U << 15),
 	I_DONTCACHE		= (1U << 16),
 	I_SYNC_QUEUED		= (1U << 17),
-	I_PINNING_NETFS_WB	= (1U << 18)
+	I_PINNING_NETFS_WB	= (1U << 18),
+	I_LUO_PRESERVED		= (1U << 19)
 };
 
 #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
index 5acee4174bf0..38df09d89433 100644
--- a/kernel/liveupdate/luo_file.c
+++ b/kernel/liveupdate/luo_file.c
@@ -248,6 +248,7 @@ static bool luo_token_is_used(struct luo_file_set *file_set, u64 token)
  * Context: Can be called from an ioctl handler during normal system operation.
  * Return: 0 on success. Returns a negative errno on failure:
  *         -EEXIST if the token is already used.
+ *         -EBUSY if the file descriptor is already preserved by another session.
  *         -EBADF if the file descriptor is invalid.
  *         -ENOSPC if the file_set is full.
  *         -ENOENT if no compatible handler is found.
@@ -276,6 +277,14 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
 	if (err)
 		goto  err_fput;
 
+	scoped_guard(spinlock, &file_inode(file)->i_lock) {
+		if (inode_state_read(file_inode(file)) & I_LUO_PRESERVED) {
+			err = -EBUSY;
+			goto err_free_files_mem;
+		}
+		inode_state_set(file_inode(file), I_LUO_PRESERVED);
+	}
+
 	err = -ENOENT;
 	list_private_for_each_entry(fh, &luo_file_handler_list, list) {
 		if (fh->ops->can_preserve(fh, file)) {
@@ -286,11 +295,11 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
 
 	/* err is still -ENOENT if no handler was found */
 	if (err)
-		goto err_free_files_mem;
+		goto err_unpreserve_inode;
 
 	err = luo_flb_file_preserve(fh);
 	if (err)
-		goto err_free_files_mem;
+		goto err_unpreserve_inode;
 
 	luo_file = kzalloc_obj(*luo_file);
 	if (!luo_file) {
@@ -320,6 +329,9 @@ int luo_preserve_file(struct luo_file_set *file_set, u64 token, int fd)
 	kfree(luo_file);
 err_flb_unpreserve:
 	luo_flb_file_unpreserve(fh);
+err_unpreserve_inode:
+	scoped_guard(spinlock, &file_inode(file)->i_lock)
+		inode_state_clear(file_inode(file), I_LUO_PRESERVED);
 err_free_files_mem:
 	luo_free_files_mem(file_set);
 err_fput:
@@ -363,6 +375,9 @@ void luo_file_unpreserve_files(struct luo_file_set *file_set)
 		luo_file->fh->ops->unpreserve(&args);
 		luo_flb_file_unpreserve(luo_file->fh);
 
+		scoped_guard(spinlock, &file_inode(luo_file->file)->i_lock)
+			inode_state_clear(file_inode(luo_file->file), I_LUO_PRESERVED);
+
 		list_del(&luo_file->list);
 		file_set->count--;
 
-- 
2.53.0.851.ga537e3e6e9-goog

Re: [RFC] liveupdate: prevent double preservation

[Pratyush Yadav]

Hi Pasha,

On Mon, Mar 16 2026, Pasha Tatashin wrote:

> Currently, LUO does not prevent the same file from being preserved twice
> across different active sessions.
>
> Add a new i_state flag I_LUO_PRESERVED and update luo_preserve_file()
> to check and set this flag when a file is preserved, and clear it in
> luo_file_unpreserve_files() when it is released. This ensures that the
> same file (inode) cannot be preserved by multiple sessions. If another
> session attempts to preserve an already preserved file, it will now
> fail with -EBUSY.

For consistency, would it be a good idea to also set this flag after
retrieve? And then clear it on finish? If we do that then I suppose we
should rename the flag to I_LUO_MANAGED or something similar.

Other than this, LGTM from LUO perspective.

Acked-by: Pratyush Yadav (Google) <pratyush@kernel.org>

[...]

-- 
Regards,
Pratyush Yadav

Re: [RFC] liveupdate: prevent double preservation

[Pasha Tatashin]

On Fri, Mar 20, 2026 at 6:31 AM Pratyush Yadav <pratyush@kernel.org> wrote:
>
> Hi Pasha,
>
> On Mon, Mar 16 2026, Pasha Tatashin wrote:
>
> > Currently, LUO does not prevent the same file from being preserved twice
> > across different active sessions.
> >
> > Add a new i_state flag I_LUO_PRESERVED and update luo_preserve_file()
> > to check and set this flag when a file is preserved, and clear it in
> > luo_file_unpreserve_files() when it is released. This ensures that the
> > same file (inode) cannot be preserved by multiple sessions. If another
> > session attempts to preserve an already preserved file, it will now
> > fail with -EBUSY.
>
> For consistency, would it be a good idea to also set this flag after
> retrieve? And then clear it on finish? If we do that then I suppose we
> should rename the flag to I_LUO_MANAGED or something similar.

Hi Pratyush,

That is a good idea. Between the retrieve and finish operations, the
file still has limitations due to LUO ownership, so keeping it flagged
as managed is useful. For example, in memfd the memory should remain
pinned, and in iommu the DMA mappings cannot be resized until finish,
VFIO also has some limitations.

I will rename the flag to I_LUO_MANAGED and update the retrieve and
finish paths in the next version.

Pasha

>
> Other than this, LGTM from LUO perspective.
>
> Acked-by: Pratyush Yadav (Google) <pratyush@kernel.org>
>
> [...]
>
> --
> Regards,
> Pratyush Yadav

Re: [RFC] liveupdate: prevent double preservation

[Jan Kara]

On Mon 16-03-26 22:38:34, Pasha Tatashin wrote:
> Currently, LUO does not prevent the same file from being preserved twice
> across different active sessions.
> 
> Add a new i_state flag I_LUO_PRESERVED and update luo_preserve_file()
> to check and set this flag when a file is preserved, and clear it in
> luo_file_unpreserve_files() when it is released. This ensures that the
> same file (inode) cannot be preserved by multiple sessions. If another
> session attempts to preserve an already preserved file, it will now
> fail with -EBUSY.
> 
> Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> ---
> 
> Background:
> Because LUO preserves files of absolutely different types: memfd, and
> upcoming  vfiofd [1], iommufd [2], guestmefd (and possible kvmfd/cpufd).
> There is no common private data or guarantee on how to prevent that the
> same file is not preserved twice beside using inode or some slower and
> expensive method like hashtables.

OK, I guess since this is a single bit, we can live with that although it
seems a bit wrong that LUO needs this in generic struct inode. But all
other "cleaner" variants I could think of were just an overkill. So feel
free to add:

Acked-by: Jan Kara <jack@suse.cz>

Just one nit below:

> [1] https://lore.kernel.org/all/20260129212510.967611-1-dmatlack@google.com
> [2] https://lore.kernel.org/all/20260203220948.2176157-1-skhawaja@google.com
> 
> @@ -744,7 +746,8 @@ enum inode_state_flags_enum {
>  	I_CREATING		= (1U << 15),
>  	I_DONTCACHE		= (1U << 16),
>  	I_SYNC_QUEUED		= (1U << 17),
> -	I_PINNING_NETFS_WB	= (1U << 18)
> +	I_PINNING_NETFS_WB	= (1U << 18),
> +	I_LUO_PRESERVED		= (1U << 19)

Add comma at the end of line here please so that we don't have to modify
the last line again.

								Honza

-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [RFC] liveupdate: prevent double preservation

[Pasha Tatashin]

On Fri, Mar 20, 2026 at 9:47 AM Jan Kara <jack@suse.cz> wrote:
>
> On Mon 16-03-26 22:38:34, Pasha Tatashin wrote:
> > Currently, LUO does not prevent the same file from being preserved twice
> > across different active sessions.
> >
> > Add a new i_state flag I_LUO_PRESERVED and update luo_preserve_file()
> > to check and set this flag when a file is preserved, and clear it in
> > luo_file_unpreserve_files() when it is released. This ensures that the
> > same file (inode) cannot be preserved by multiple sessions. If another
> > session attempts to preserve an already preserved file, it will now
> > fail with -EBUSY.
> >
> > Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> > ---
> >
> > Background:
> > Because LUO preserves files of absolutely different types: memfd, and
> > upcoming  vfiofd [1], iommufd [2], guestmefd (and possible kvmfd/cpufd).
> > There is no common private data or guarantee on how to prevent that the
> > same file is not preserved twice beside using inode or some slower and
> > expensive method like hashtables.
>
> OK, I guess since this is a single bit, we can live with that although it
> seems a bit wrong that LUO needs this in generic struct inode. But all
> other "cleaner" variants I could think of were just an overkill. So feel
> free to add:
>
> Acked-by: Jan Kara <jack@suse.cz>
>
> Just one nit below:
>
> > [1] https://lore.kernel.org/all/20260129212510.967611-1-dmatlack@google.com
> > [2] https://lore.kernel.org/all/20260203220948.2176157-1-skhawaja@google.com
> >
> > @@ -744,7 +746,8 @@ enum inode_state_flags_enum {
> >       I_CREATING              = (1U << 15),
> >       I_DONTCACHE             = (1U << 16),
> >       I_SYNC_QUEUED           = (1U << 17),
> > -     I_PINNING_NETFS_WB      = (1U << 18)
> > +     I_PINNING_NETFS_WB      = (1U << 18),
> > +     I_LUO_PRESERVED         = (1U << 19)
>
> Add comma at the end of line here please so that we don't have to modify
> the last line again.

Will do.

Thank you,
Pasha

>
>                                                                 Honza
>
> --
> Jan Kara <jack@suse.com>
> SUSE Labs, CR