Re: [PATCH 2/9] kho: Make bootmem reservations visible to fleet monitoring

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] kho: scratch memory corruption on error path in kho_init()
  [1]
--

commit 96d77d1af62b4778bf7f34ac023280de65f57337
Author: Chris Down <chris@chrisdown.name>

kho: Make bootmem reservations visible to fleet monitoring

This commit exposes the total KHO bootmem reservation size in bytes via a
new read-only sysfs attribute at /sys/kernel/kexec/kho_bootmem_size.

> diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
> index 3046b89e5db49..21d77e29d2bb8 100644
> --- a/kernel/liveupdate/kexec_handover.c
> +++ b/kernel/liveupdate/kexec_handover.c
> @@ -942,6 +942,21 @@ static void __init kho_reserve_bootmem(void)
>  	kho_enable = false;
>  }
>  
> +phys_addr_t kho_bootmem_size(void)
> +{
> +	phys_addr_t size = 0;
> +	unsigned int i;
> +
> +	/* kho_init() can disable KHO without clearing kho_bootmem_cnt. */
> +	if (!kho_enable)
> +		return 0;
> +
> +	for (i = 0; i < kho_bootmem_cnt; i++)
> +		size += kho_bootmem[i].size;
> +
> +	return size;
> +}

[Severity: Critical]
This problem wasn't introduced by this patch, but on the kho_init() error
path referenced by this comment, can err_free_bootmem corrupt active memory
during a KHO kexec boot [1]?

During a KHO boot (when fdt is non-NULL), early memblock allocations are
served from the incoming kho_bootmem regions, and memblock_free_all()
releases the remaining unallocated bootmem pages to the buddy allocator.
While the normal path in kho_init() returns early when fdt is non-NULL
before converting kho_bootmem to CMA, the error path frees every
kho_bootmem region unconditionally:

kernel/liveupdate/kexec_handover.c:kho_init() {
    ...
	if (fdt)
		return 0;
    ...
err_free_bootmem:
	kho_out.fdt = NULL;
	for (int i = 0; i < kho_bootmem_cnt; i++) {
		void *start = __va(kho_bootmem[i].addr);
		void *end = start + kho_bootmem[i].size;

		free_reserved_area(start, end, -1, "");
	}
	kho_enable = false;
	return err;
}

If an initialization step such as kho_alloc_preserve() fails on a KHO boot,
free_reserved_area() runs on pages that are either in use by early-boot
allocations or already managed by the buddy allocator, causing
use-after-free and double free memory corruption.

[1] https://sashiko.dev/#/bug/linux-5ae80b0f-97ab-4112-a0a4-c767da72f4a8

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1794383544.git.chris@chrisdown.name?part=2