* [PATCH] mm/memfd_luo: validate serialized_data before conversion
@ 2026-06-11 10:30 Tarun Sahu
2026-06-11 12:32 ` Pratyush Yadav
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Tarun Sahu @ 2026-06-11 10:30 UTC (permalink / raw)
To: Pasha Tatashin, Mike Rapoport, Pratyush Yadav, Andrew Morton
Cc: linux-kernel, kexec, linux-mm, Tarun Sahu
In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
on args->serialized_data before checking if the physical address is valid.
Since physical address 0 does not map to virtual NULL (due to direct
mapping offsets), the subsequent check 'if (!ser)' was ineffective at
catching a missing serialized_data, leading to unsafe dereferences later.
Validate that args->serialized_data is non-zero before calling
phys_to_virt().
Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
Signed-off-by: Tarun Sahu <tarunsahu@google.com>
---
mm/memfd_luo.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
index 59de210bee5f..10f3983b0060 100644
--- a/mm/memfd_luo.c
+++ b/mm/memfd_luo.c
@@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
if (args->retrieve_status)
return;
- ser = phys_to_virt(args->serialized_data);
- if (!ser)
+ if (!args->serialized_data)
return;
+ ser = phys_to_virt(args->serialized_data);
+
if (ser->nr_folios) {
folios_ser = kho_restore_vmalloc(&ser->folios);
if (!folios_ser)
@@ -522,10 +523,11 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
struct file *file;
int err;
- ser = phys_to_virt(args->serialized_data);
- if (!ser)
+ if (!args->serialized_data)
return -EINVAL;
+ ser = phys_to_virt(args->serialized_data);
+
/* Make sure the file only has seals supported by this version. */
if (ser->seals & ~MEMFD_LUO_ALL_SEALS) {
err = -EOPNOTSUPP;
base-commit: 9716c086c8e8b141d35aa61f2e96a2e83de212a7
--
2.54.0.1099.g489fc7bff1-goog
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion
2026-06-11 10:30 [PATCH] mm/memfd_luo: validate serialized_data before conversion Tarun Sahu
@ 2026-06-11 12:32 ` Pratyush Yadav
2026-06-11 12:40 ` Mike Rapoport
2026-06-11 18:11 ` Pasha Tatashin
2 siblings, 0 replies; 7+ messages in thread
From: Pratyush Yadav @ 2026-06-11 12:32 UTC (permalink / raw)
To: Tarun Sahu
Cc: Pasha Tatashin, Mike Rapoport, Pratyush Yadav, Andrew Morton,
linux-kernel, kexec, linux-mm
On Thu, Jun 11 2026, Tarun Sahu wrote:
> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> on args->serialized_data before checking if the physical address is valid.
> Since physical address 0 does not map to virtual NULL (due to direct
Nit: this is only true on ARM64. On x86 physical address of 0 maps to
NULL.
Other than this,
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> catching a missing serialized_data, leading to unsafe dereferences later.
>
> Validate that args->serialized_data is non-zero before calling
> phys_to_virt().
>
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
[...]
--
Regards,
Pratyush Yadav
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion
2026-06-11 10:30 [PATCH] mm/memfd_luo: validate serialized_data before conversion Tarun Sahu
2026-06-11 12:32 ` Pratyush Yadav
@ 2026-06-11 12:40 ` Mike Rapoport
2026-06-11 13:37 ` Pratyush Yadav
2026-06-11 18:11 ` Pasha Tatashin
2 siblings, 1 reply; 7+ messages in thread
From: Mike Rapoport @ 2026-06-11 12:40 UTC (permalink / raw)
To: Tarun Sahu
Cc: Pasha Tatashin, Pratyush Yadav, Andrew Morton, linux-kernel,
kexec, linux-mm
On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> on args->serialized_data before checking if the physical address is valid.
> Since physical address 0 does not map to virtual NULL (due to direct
> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> catching a missing serialized_data, leading to unsafe dereferences later.
>
> Validate that args->serialized_data is non-zero before calling
> phys_to_virt().
>
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
> ---
> mm/memfd_luo.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> index 59de210bee5f..10f3983b0060 100644
> --- a/mm/memfd_luo.c
> +++ b/mm/memfd_luo.c
> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
> if (args->retrieve_status)
> return;
>
> - ser = phys_to_virt(args->serialized_data);
> - if (!ser)
> + if (!args->serialized_data)
We really should make args->serialized_data a KHOSER_PTR
> return;
>
> + ser = phys_to_virt(args->serialized_data);
> +
> if (ser->nr_folios) {
> folios_ser = kho_restore_vmalloc(&ser->folios);
> if (!folios_ser)
> @@ -522,10 +523,11 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
> struct file *file;
> int err;
>
> - ser = phys_to_virt(args->serialized_data);
> - if (!ser)
> + if (!args->serialized_data)
> return -EINVAL;
>
> + ser = phys_to_virt(args->serialized_data);
> +
> /* Make sure the file only has seals supported by this version. */
> if (ser->seals & ~MEMFD_LUO_ALL_SEALS) {
> err = -EOPNOTSUPP;
>
> base-commit: 9716c086c8e8b141d35aa61f2e96a2e83de212a7
> --
> 2.54.0.1099.g489fc7bff1-goog
>
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion
2026-06-11 12:40 ` Mike Rapoport
@ 2026-06-11 13:37 ` Pratyush Yadav
2026-06-11 14:28 ` Mike Rapoport
0 siblings, 1 reply; 7+ messages in thread
From: Pratyush Yadav @ 2026-06-11 13:37 UTC (permalink / raw)
To: Mike Rapoport
Cc: Tarun Sahu, Pasha Tatashin, Pratyush Yadav, Andrew Morton,
linux-kernel, kexec, linux-mm
On Thu, Jun 11 2026, Mike Rapoport wrote:
> On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
>> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
>> on args->serialized_data before checking if the physical address is valid.
>> Since physical address 0 does not map to virtual NULL (due to direct
>> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
>> catching a missing serialized_data, leading to unsafe dereferences later.
>>
>> Validate that args->serialized_data is non-zero before calling
>> phys_to_virt().
>>
>> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
>> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
>> ---
>> mm/memfd_luo.c | 10 ++++++----
>> 1 file changed, 6 insertions(+), 4 deletions(-)
>>
>> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
>> index 59de210bee5f..10f3983b0060 100644
>> --- a/mm/memfd_luo.c
>> +++ b/mm/memfd_luo.c
>> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
>> if (args->retrieve_status)
>> return;
>>
>> - ser = phys_to_virt(args->serialized_data);
>> - if (!ser)
>> + if (!args->serialized_data)
>
> We really should make args->serialized_data a KHOSER_PTR
Hmm, that would also be a good idea. I suppose then it would be a better
to directly convert to using KHOSER_PTR() instead of this patch?
>
>> return;
>>
>> + ser = phys_to_virt(args->serialized_data);
>> +
>> if (ser->nr_folios) {
>> folios_ser = kho_restore_vmalloc(&ser->folios);
>> if (!folios_ser)
>> @@ -522,10 +523,11 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
>> struct file *file;
>> int err;
>>
>> - ser = phys_to_virt(args->serialized_data);
>> - if (!ser)
>> + if (!args->serialized_data)
>> return -EINVAL;
>>
>> + ser = phys_to_virt(args->serialized_data);
>> +
>> /* Make sure the file only has seals supported by this version. */
>> if (ser->seals & ~MEMFD_LUO_ALL_SEALS) {
>> err = -EOPNOTSUPP;
>>
>> base-commit: 9716c086c8e8b141d35aa61f2e96a2e83de212a7
>> --
>> 2.54.0.1099.g489fc7bff1-goog
>>
--
Regards,
Pratyush Yadav
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion
2026-06-11 13:37 ` Pratyush Yadav
@ 2026-06-11 14:28 ` Mike Rapoport
2026-06-11 18:11 ` Pasha Tatashin
0 siblings, 1 reply; 7+ messages in thread
From: Mike Rapoport @ 2026-06-11 14:28 UTC (permalink / raw)
To: Pratyush Yadav
Cc: Tarun Sahu, Pasha Tatashin, Andrew Morton, linux-kernel, kexec,
linux-mm
On Thu, Jun 11, 2026 at 03:37:12PM +0200, Pratyush Yadav wrote:
> On Thu, Jun 11 2026, Mike Rapoport wrote:
>
> > On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
> >> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> >> on args->serialized_data before checking if the physical address is valid.
> >> Since physical address 0 does not map to virtual NULL (due to direct
> >> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> >> catching a missing serialized_data, leading to unsafe dereferences later.
> >>
> >> Validate that args->serialized_data is non-zero before calling
> >> phys_to_virt().
> >>
> >> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> >> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
> >> ---
> >> mm/memfd_luo.c | 10 ++++++----
> >> 1 file changed, 6 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> >> index 59de210bee5f..10f3983b0060 100644
> >> --- a/mm/memfd_luo.c
> >> +++ b/mm/memfd_luo.c
> >> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
> >> if (args->retrieve_status)
> >> return;
> >>
> >> - ser = phys_to_virt(args->serialized_data);
> >> - if (!ser)
> >> + if (!args->serialized_data)
> >
> > We really should make args->serialized_data a KHOSER_PTR
>
> Hmm, that would also be a good idea. I suppose then it would be a better
> to directly convert to using KHOSER_PTR() instead of this patch?
Makes sense.
> --
> Regards,
> Pratyush Yadav
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion
2026-06-11 14:28 ` Mike Rapoport
@ 2026-06-11 18:11 ` Pasha Tatashin
0 siblings, 0 replies; 7+ messages in thread
From: Pasha Tatashin @ 2026-06-11 18:11 UTC (permalink / raw)
To: Mike Rapoport
Cc: Pratyush Yadav, Tarun Sahu, Pasha Tatashin, Andrew Morton,
linux-kernel, kexec, linux-mm
On 06-11 17:28, Mike Rapoport wrote:
> On Thu, Jun 11, 2026 at 03:37:12PM +0200, Pratyush Yadav wrote:
> > On Thu, Jun 11 2026, Mike Rapoport wrote:
> >
> > > On Thu, Jun 11, 2026 at 10:30:03AM +0000, Tarun Sahu wrote:
> > >> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> > >> on args->serialized_data before checking if the physical address is valid.
> > >> Since physical address 0 does not map to virtual NULL (due to direct
> > >> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> > >> catching a missing serialized_data, leading to unsafe dereferences later.
> > >>
> > >> Validate that args->serialized_data is non-zero before calling
> > >> phys_to_virt().
> > >>
> > >> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> > >> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
> > >> ---
> > >> mm/memfd_luo.c | 10 ++++++----
> > >> 1 file changed, 6 insertions(+), 4 deletions(-)
> > >>
> > >> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> > >> index 59de210bee5f..10f3983b0060 100644
> > >> --- a/mm/memfd_luo.c
> > >> +++ b/mm/memfd_luo.c
> > >> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
> > >> if (args->retrieve_status)
> > >> return;
> > >>
> > >> - ser = phys_to_virt(args->serialized_data);
> > >> - if (!ser)
> > >> + if (!args->serialized_data)
> > >
> > > We really should make args->serialized_data a KHOSER_PTR
> >
> > Hmm, that would also be a good idea. I suppose then it would be a better
> > to directly convert to using KHOSER_PTR() instead of this patch?
>
> Makes sense.
I think we should systematically cover all phys_to_virt conversions
and add KOSHER_PTR() , instead of an ad-hoc approach of adding it as we
go. So, let's take this patch and do a series where we properly convert
everything and provide guidance for others to use going forward.
Pasha
>
> > --
> > Regards,
> > Pratyush Yadav
>
> --
> Sincerely yours,
> Mike.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] mm/memfd_luo: validate serialized_data before conversion
2026-06-11 10:30 [PATCH] mm/memfd_luo: validate serialized_data before conversion Tarun Sahu
2026-06-11 12:32 ` Pratyush Yadav
2026-06-11 12:40 ` Mike Rapoport
@ 2026-06-11 18:11 ` Pasha Tatashin
2 siblings, 0 replies; 7+ messages in thread
From: Pasha Tatashin @ 2026-06-11 18:11 UTC (permalink / raw)
To: Tarun Sahu
Cc: Pasha Tatashin, Mike Rapoport, Pratyush Yadav, Andrew Morton,
linux-kernel, kexec, linux-mm
On 06-11 10:30, Tarun Sahu wrote:
> In memfd_luo_finish() and memfd_luo_retrieve(), phys_to_virt() was called
> on args->serialized_data before checking if the physical address is valid.
> Since physical address 0 does not map to virtual NULL (due to direct
> mapping offsets), the subsequent check 'if (!ser)' was ineffective at
> catching a missing serialized_data, leading to unsafe dereferences later.
>
> Validate that args->serialized_data is non-zero before calling
> phys_to_virt().
>
> Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd")
> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> ---
> mm/memfd_luo.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
> index 59de210bee5f..10f3983b0060 100644
> --- a/mm/memfd_luo.c
> +++ b/mm/memfd_luo.c
> @@ -397,10 +397,11 @@ static void memfd_luo_finish(struct liveupdate_file_op_args *args)
> if (args->retrieve_status)
> return;
>
> - ser = phys_to_virt(args->serialized_data);
> - if (!ser)
> + if (!args->serialized_data)
> return;
>
> + ser = phys_to_virt(args->serialized_data);
> +
> if (ser->nr_folios) {
> folios_ser = kho_restore_vmalloc(&ser->folios);
> if (!folios_ser)
> @@ -522,10 +523,11 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
> struct file *file;
> int err;
>
> - ser = phys_to_virt(args->serialized_data);
> - if (!ser)
> + if (!args->serialized_data)
> return -EINVAL;
>
> + ser = phys_to_virt(args->serialized_data);
> +
> /* Make sure the file only has seals supported by this version. */
> if (ser->seals & ~MEMFD_LUO_ALL_SEALS) {
> err = -EOPNOTSUPP;
>
> base-commit: 9716c086c8e8b141d35aa61f2e96a2e83de212a7
> --
> 2.54.0.1099.g489fc7bff1-goog
>
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-06-11 18:11 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-11 10:30 [PATCH] mm/memfd_luo: validate serialized_data before conversion Tarun Sahu
2026-06-11 12:32 ` Pratyush Yadav
2026-06-11 12:40 ` Mike Rapoport
2026-06-11 13:37 ` Pratyush Yadav
2026-06-11 14:28 ` Mike Rapoport
2026-06-11 18:11 ` Pasha Tatashin
2026-06-11 18:11 ` Pasha Tatashin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox