* [PATCH] liveupdate: validate session type before performing operation
@ 2026-05-19 12:24 Pratyush Yadav
2026-05-19 14:11 ` Pasha Tatashin
0 siblings, 1 reply; 3+ messages in thread
From: Pratyush Yadav @ 2026-05-19 12:24 UTC (permalink / raw)
To: Pasha Tatashin, Mike Rapoport, Pratyush Yadav, Andrew Morton
Cc: linux-kernel, kexec, stable
From: "Pratyush Yadav (Google)" <pratyush@kernel.org>
The sessions ioctls are not applicable to all session types. PRESERVE_FD
is only applicable to outgoing sessions. RETRIEVE_FD and FINISH are only
valid for incoming session. Calling a incoming ioctl on an outgoing
session is invalid and can cause file handlers to run into unexpected
errors.
For example, a user can create a (outgoing) session, preserve a memfd,
and then immediately do a retrieve without doing a kexec in between.
This would result in memfd's retrieve handler to run. The handlers
expects to be called from a post-kexec context, and will try to do a
kho_restore_vmalloc() or kho_restore_folio() to try and restore memory.
KHO catches this (thanks to KHO_PAGE_MAGIC) and returns an error, but
since this is considered an internal error and KHO throws out a bunch of
WARN()s.
Associate a type with each ioctl op and validate the type in
luo_session_ioctl() before dispatching the ioctl handler to make sure
the op is being called for the right session type.
Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation")
Cc: stable@vger.kernel.org
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
---
Notes:
I added LUO_IOCTL_ALL but there is no user in this patch. The type is
for LIVEUPDATE_SESSION_GET_NAME which is supported for both session
types. The support for GET_NAME is in next and this patch should go
through fixes.
Alternatively, we can remove LUO_IOCTL_ALL from this patch and add it to
the LIVEUPDATE_SESSION_GET_NAME patch in next. But that would need us to
rebase to an rc that contains this fix.
kernel/liveupdate/luo_session.c | 36 +++++++++++++++++++++++++++++----
1 file changed, 32 insertions(+), 4 deletions(-)
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index a3327a28fc1f..e84218e3cacb 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -295,32 +295,58 @@ union ucmd_buffer {
struct liveupdate_session_retrieve_fd retrieve;
};
+/* Type of sessions the ioctl applies to. */
+enum luo_ioctl_type {
+ LUO_IOCTL_INCOMING,
+ LUO_IOCTL_OUTGOING,
+ LUO_IOCTL_ALL,
+};
+
struct luo_ioctl_op {
unsigned int size;
unsigned int min_size;
unsigned int ioctl_num;
+ enum luo_ioctl_type type;
int (*execute)(struct luo_session *session, struct luo_ucmd *ucmd);
};
-#define IOCTL_OP(_ioctl, _fn, _struct, _last) \
+#define IOCTL_OP(_ioctl, _fn, _struct, _last, _type) \
[_IOC_NR(_ioctl) - LIVEUPDATE_CMD_SESSION_BASE] = { \
.size = sizeof(_struct) + \
BUILD_BUG_ON_ZERO(sizeof(union ucmd_buffer) < \
sizeof(_struct)), \
.min_size = offsetofend(_struct, _last), \
.ioctl_num = _ioctl, \
+ .type = _type, \
.execute = _fn, \
}
static const struct luo_ioctl_op luo_session_ioctl_ops[] = {
IOCTL_OP(LIVEUPDATE_SESSION_FINISH, luo_session_finish,
- struct liveupdate_session_finish, reserved),
+ struct liveupdate_session_finish, reserved, LUO_IOCTL_INCOMING),
IOCTL_OP(LIVEUPDATE_SESSION_PRESERVE_FD, luo_session_preserve_fd,
- struct liveupdate_session_preserve_fd, token),
+ struct liveupdate_session_preserve_fd, token, LUO_IOCTL_OUTGOING),
IOCTL_OP(LIVEUPDATE_SESSION_RETRIEVE_FD, luo_session_retrieve_fd,
- struct liveupdate_session_retrieve_fd, token),
+ struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_INCOMING),
};
+static bool luo_ioctl_type_valid(struct luo_session *session,
+ const struct luo_ioctl_op *op)
+{
+ switch (op->type) {
+ case LUO_IOCTL_INCOMING:
+ /* Retrieved is only set on incoming sessions */
+ return session->retrieved;
+ case LUO_IOCTL_OUTGOING:
+ return !session->retrieved;
+ case LUO_IOCTL_ALL:
+ return true;
+ }
+
+ /* Catch-all. */
+ return false;
+}
+
static long luo_session_ioctl(struct file *filep, unsigned int cmd,
unsigned long arg)
{
@@ -345,6 +371,8 @@ static long luo_session_ioctl(struct file *filep, unsigned int cmd,
op = &luo_session_ioctl_ops[nr - LIVEUPDATE_CMD_SESSION_BASE];
if (op->ioctl_num != cmd)
return -ENOIOCTLCMD;
+ if (!luo_ioctl_type_valid(session, op))
+ return -EINVAL;
if (ucmd.user_size < op->min_size)
return -EINVAL;
base-commit: b1378127003b61930ce30064328640503ad3ef6d
--
2.54.0.563.g4f69b47b94-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] liveupdate: validate session type before performing operation
2026-05-19 12:24 [PATCH] liveupdate: validate session type before performing operation Pratyush Yadav
@ 2026-05-19 14:11 ` Pasha Tatashin
2026-05-19 14:29 ` Pratyush Yadav
0 siblings, 1 reply; 3+ messages in thread
From: Pasha Tatashin @ 2026-05-19 14:11 UTC (permalink / raw)
To: Pratyush Yadav
Cc: Pasha Tatashin, Mike Rapoport, Andrew Morton, linux-kernel, kexec,
stable
On 05-19 14:24, Pratyush Yadav wrote:
> From: "Pratyush Yadav (Google)" <pratyush@kernel.org>
>
> The sessions ioctls are not applicable to all session types. PRESERVE_FD
> is only applicable to outgoing sessions. RETRIEVE_FD and FINISH are only
> valid for incoming session. Calling a incoming ioctl on an outgoing
> session is invalid and can cause file handlers to run into unexpected
> errors.
>
> For example, a user can create a (outgoing) session, preserve a memfd,
> and then immediately do a retrieve without doing a kexec in between.
Please add a self-test tools/testing/selftests/liveupdate/liveupdate.c
to verify that outgoing sessions do not accept retrieve_fd ioctl.
Option, you could also add to luo_multi_session.c a test to verifying
that incoming does not accept preserve_fd
> This would result in memfd's retrieve handler to run. The handlers
> expects to be called from a post-kexec context, and will try to do a
> kho_restore_vmalloc() or kho_restore_folio() to try and restore memory.
>
> KHO catches this (thanks to KHO_PAGE_MAGIC) and returns an error, but
> since this is considered an internal error and KHO throws out a bunch of
> WARN()s.
>
> Associate a type with each ioctl op and validate the type in
> luo_session_ioctl() before dispatching the ioctl handler to make sure
> the op is being called for the right session type.
>
> Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
> ---
>
> Notes:
> I added LUO_IOCTL_ALL but there is no user in this patch. The type is
> for LIVEUPDATE_SESSION_GET_NAME which is supported for both session
> types. The support for GET_NAME is in next and this patch should go
> through fixes.
>
> Alternatively, we can remove LUO_IOCTL_ALL from this patch and add it to
> the LIVEUPDATE_SESSION_GET_NAME patch in next. But that would need us to
> rebase to an rc that contains this fix.
Let's keep LUO_IOCTL_ALL change in this patch.
Please add tests, otherwise LGTM.
Pasha
>
> kernel/liveupdate/luo_session.c | 36 +++++++++++++++++++++++++++++----
> 1 file changed, 32 insertions(+), 4 deletions(-)
>
> diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
> index a3327a28fc1f..e84218e3cacb 100644
> --- a/kernel/liveupdate/luo_session.c
> +++ b/kernel/liveupdate/luo_session.c
> @@ -295,32 +295,58 @@ union ucmd_buffer {
> struct liveupdate_session_retrieve_fd retrieve;
> };
>
> +/* Type of sessions the ioctl applies to. */
> +enum luo_ioctl_type {
> + LUO_IOCTL_INCOMING,
> + LUO_IOCTL_OUTGOING,
> + LUO_IOCTL_ALL,
> +};
> +
> struct luo_ioctl_op {
> unsigned int size;
> unsigned int min_size;
> unsigned int ioctl_num;
> + enum luo_ioctl_type type;
> int (*execute)(struct luo_session *session, struct luo_ucmd *ucmd);
> };
>
> -#define IOCTL_OP(_ioctl, _fn, _struct, _last) \
> +#define IOCTL_OP(_ioctl, _fn, _struct, _last, _type) \
> [_IOC_NR(_ioctl) - LIVEUPDATE_CMD_SESSION_BASE] = { \
> .size = sizeof(_struct) + \
> BUILD_BUG_ON_ZERO(sizeof(union ucmd_buffer) < \
> sizeof(_struct)), \
> .min_size = offsetofend(_struct, _last), \
> .ioctl_num = _ioctl, \
> + .type = _type, \
> .execute = _fn, \
> }
>
> static const struct luo_ioctl_op luo_session_ioctl_ops[] = {
> IOCTL_OP(LIVEUPDATE_SESSION_FINISH, luo_session_finish,
> - struct liveupdate_session_finish, reserved),
> + struct liveupdate_session_finish, reserved, LUO_IOCTL_INCOMING),
> IOCTL_OP(LIVEUPDATE_SESSION_PRESERVE_FD, luo_session_preserve_fd,
> - struct liveupdate_session_preserve_fd, token),
> + struct liveupdate_session_preserve_fd, token, LUO_IOCTL_OUTGOING),
> IOCTL_OP(LIVEUPDATE_SESSION_RETRIEVE_FD, luo_session_retrieve_fd,
> - struct liveupdate_session_retrieve_fd, token),
> + struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_INCOMING),
> };
>
> +static bool luo_ioctl_type_valid(struct luo_session *session,
> + const struct luo_ioctl_op *op)
> +{
> + switch (op->type) {
> + case LUO_IOCTL_INCOMING:
> + /* Retrieved is only set on incoming sessions */
> + return session->retrieved;
> + case LUO_IOCTL_OUTGOING:
> + return !session->retrieved;
> + case LUO_IOCTL_ALL:
> + return true;
> + }
> +
> + /* Catch-all. */
> + return false;
> +}
> +
> static long luo_session_ioctl(struct file *filep, unsigned int cmd,
> unsigned long arg)
> {
> @@ -345,6 +371,8 @@ static long luo_session_ioctl(struct file *filep, unsigned int cmd,
> op = &luo_session_ioctl_ops[nr - LIVEUPDATE_CMD_SESSION_BASE];
> if (op->ioctl_num != cmd)
> return -ENOIOCTLCMD;
> + if (!luo_ioctl_type_valid(session, op))
> + return -EINVAL;
> if (ucmd.user_size < op->min_size)
> return -EINVAL;
>
>
> base-commit: b1378127003b61930ce30064328640503ad3ef6d
> --
> 2.54.0.563.g4f69b47b94-goog
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] liveupdate: validate session type before performing operation
2026-05-19 14:11 ` Pasha Tatashin
@ 2026-05-19 14:29 ` Pratyush Yadav
0 siblings, 0 replies; 3+ messages in thread
From: Pratyush Yadav @ 2026-05-19 14:29 UTC (permalink / raw)
To: Pasha Tatashin
Cc: Pratyush Yadav, Mike Rapoport, Andrew Morton, linux-kernel, kexec,
stable
On Tue, May 19 2026, Pasha Tatashin wrote:
> On 05-19 14:24, Pratyush Yadav wrote:
>> From: "Pratyush Yadav (Google)" <pratyush@kernel.org>
>>
>> The sessions ioctls are not applicable to all session types. PRESERVE_FD
>> is only applicable to outgoing sessions. RETRIEVE_FD and FINISH are only
>> valid for incoming session. Calling a incoming ioctl on an outgoing
>> session is invalid and can cause file handlers to run into unexpected
>> errors.
>>
>> For example, a user can create a (outgoing) session, preserve a memfd,
>> and then immediately do a retrieve without doing a kexec in between.
>
> Please add a self-test tools/testing/selftests/liveupdate/liveupdate.c
> to verify that outgoing sessions do not accept retrieve_fd ioctl.
> Option, you could also add to luo_multi_session.c a test to verifying
> that incoming does not accept preserve_fd
Right, forgot about that. Will do.
>
>> This would result in memfd's retrieve handler to run. The handlers
>> expects to be called from a post-kexec context, and will try to do a
>> kho_restore_vmalloc() or kho_restore_folio() to try and restore memory.
>>
>> KHO catches this (thanks to KHO_PAGE_MAGIC) and returns an error, but
>> since this is considered an internal error and KHO throws out a bunch of
>> WARN()s.
>>
>> Associate a type with each ioctl op and validate the type in
>> luo_session_ioctl() before dispatching the ioctl handler to make sure
>> the op is being called for the right session type.
>>
>> Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
--
Regards,
Pratyush Yadav
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-19 14:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-19 12:24 [PATCH] liveupdate: validate session type before performing operation Pratyush Yadav
2026-05-19 14:11 ` Pasha Tatashin
2026-05-19 14:29 ` Pratyush Yadav
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox