linux-stable.git/kernel/liveupdate, branch v7.1.5

liveupdate: validate session type before performing operation

2026-07-24T14:21:26+00:00

[ Upstream commit 507e3b479f9c6d85135eb5e1a77fb3fddb259ad8 ]

The sessions ioctls are not applicable to all session types. PRESERVE_FD
is only applicable to outgoing sessions. RETRIEVE_FD and FINISH are only
valid for incoming session. Calling a incoming ioctl on an outgoing
session is invalid and can cause file handlers to run into unexpected
errors.

For example, a user can create a (outgoing) session, preserve a memfd,
and then immediately do a retrieve without doing a kexec in between.
This would result in memfd's retrieve handler to run. The handlers
expects to be called from a post-kexec context, and will try to do a
kho_restore_vmalloc() or kho_restore_folio() to try and restore memory.

KHO catches this (thanks to KHO_PAGE_MAGIC) and returns an error, but
since this is considered an internal error and KHO throws out a bunch of
WARN()s.

Associate a type with each ioctl op and validate the type in
luo_session_ioctl() before dispatching the ioctl handler to make sure
the op is being called for the right session type.

Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation")
Cc: stable@vger.kernel.org
Signed-off-by: Pratyush Yadav (Google) 
Link: https://patch.msgid.link/20260519122428.2378446-1-pratyush@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES

2026-07-24T14:21:03+00:00

commit 0e39380a7316122e1b00012b3f3cd3e318b3e7d3 upstream.

When using scratch_scale, the scratch sizes are rounded up to
CMA_MIN_ALIGNMENT_BYTES since they will be released as MIGRATE_CMA. This
is not done when using fixed scratch sizes via command line. This can
result in user specifying a size which is not aligned, and thus kernel
releasing a pageblock that is only partially scratch.

Do the rounding up for both cases in scratch_size_update().

Fixes: 3dc92c311498 ("kexec: add Kexec HandOver (KHO) generation helpers")
Cc: stable@kernel.org
Signed-off-by: Pratyush Yadav (Google) 
Link: https://patch.msgid.link/20260519160554.2713361-1-pratyush@kernel.org
Signed-off-by: Pasha Tatashin 
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Greg Kroah-Hartman

liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()

2026-07-24T14:19:27+00:00

[ Upstream commit 291dcd37c8c8f8f8e1bccc92228f44bf371762a8 ]

In luo_file_unpreserve_files() and luo_file_finish(), reorder
module_put() and xa_erase() to ensure the file handler module remains
pinned while its operations are being accessed.

Specifically, luo_get_id() dereferences fh->ops->get_id, so the module
reference must be held until after xa_erase() (which calls luo_get_id)
completes.

For luo_file_finish(), this requires moving the module_put() call out of
the luo_file_finish_one() helper and into the main loop of
luo_file_finish() itself.

Fixes: 00d0b372374f ("liveupdate: prevent double management of files")
Acked-by: Mike Rapoport (Microsoft) 
Reviewed-by: Pratyush Yadav (Google) 
Signed-off-by: Pasha Tatashin 
Link: https://patch.msgid.link/20260527202737.1345192-5-pasha.tatashin@soleen.com
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Sasha Levin

liveupdate: block session mutations during reboot

2026-07-24T14:19:27+00:00

[ Upstream commit bb1328be35bf43c88288c5c31ceb45181b574c0c ]

During the reboot() syscall, user processes may still be running
concurrently and attempting to mutate sessions (e.g., creating,
retrieving, or releasing sessions). To prevent this, introduce
luo_session_serialize_rwsem to synchronize mutations with the
serialization process.

All session mutation operations (create, retrieve, release, ioctl) take
the read lock. The serialization process (luo_session_serialize) takes
the write lock and holds it indefinitely on success. This effectively
freezes the LUO session subsystem during the transition to the new
kernel. If serialization fails, the lock is released to allow recovery.

Fixes: 0153094d03df ("liveupdate: luo_session: add sessions support")
Reported-by: Oskar Gerlicz Kowalczuk 
Acked-by: Mike Rapoport (Microsoft) 
Signed-off-by: Pasha Tatashin 
Reviewed-by: Pratyush Yadav (Google) 
Link: https://patch.msgid.link/20260527202737.1345192-4-pasha.tatashin@soleen.com
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Sasha Levin

liveupdate: fix TOCTOU race in luo_session_retrieve()

2026-07-24T14:19:27+00:00

[ Upstream commit d3ae9e7fddb4036f50003d7fa1ef52801fdb961b ]

Extend the scope of the rwsem_read lock in luo_session_retrieve() to
overlap with the acquisition of the session mutex. This prevents a
concurrent thread from releasing and freeing the session between the
lookup and the mutex lock.

Fixes: 0153094d03df ("liveupdate: luo_session: add sessions support")
Acked-by: Mike Rapoport (Microsoft) 
Reviewed-by: Pratyush Yadav (Google) 
Signed-off-by: Pasha Tatashin 
Link: https://patch.msgid.link/20260527202737.1345192-3-pasha.tatashin@soleen.com
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Sasha Levin

liveupdate: Reference count incoming FLB data

2026-07-24T14:19:27+00:00

[ Upstream commit d8e47bd066d7e626f9f45d416182d585b7e18b9b ]

Increment the incoming FLB refcount in liveupdate_flb_get_incoming() so
that the FLB structure cannot be freed while the caller is actively using
it. Add an additional liveupdate_flb_put_incoming() function so the
caller can explicitly indicate when it is done using the FLB data.

During a Live Update, a subsystem might need to hold onto the incoming
File-Lifecycle-Bound (FLB) data for an extended period, such as during
device enumeration. Incrementing the reference count guarantees that the
data remains valid and accessible until the subsystem releases it,
preventing future use-after-free bugs.

Fixes: cab056f2aae7 ("liveupdate: luo_flb: introduce File-Lifecycle-Bound global state")
Signed-off-by: David Matlack 
Reviewed-by: Samiullah Khawaja 
Reviewed-by: Pasha Tatashin 
Link: https://lore.kernel.org/r/20260423174032.3140399-3-dmatlack@google.com
Signed-off-by: Pasha Tatashin 
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Sasha Levin

liveupdate: Use refcount_t for FLB reference counts

2026-07-24T14:19:27+00:00

[ Upstream commit d2850ff2f8c5acda4c1097aa53c006a75b091f2c ]

Use refcount_t instead of a raw integer to keep track of references on
incoming and outgoing FLBs. Using refcount_t provides protection from
overflow, underflow, and other issues.

Fixes: cab056f2aae7 ("liveupdate: luo_flb: introduce File-Lifecycle-Bound global state")
Signed-off-by: David Matlack 
Reviewed-by: Samiullah Khawaja 
Reviewed-by: Pasha Tatashin 
Link: https://lore.kernel.org/r/20260423174032.3140399-2-dmatlack@google.com
Signed-off-by: Pasha Tatashin 
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Sasha Levin

liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name length

2026-07-18T14:55:43+00:00

commit e947433cd0d2b95a277757451b9b9c2714136dc2 upstream.

A session name must not be an empty string, and must not exceed the
maximum size define in the uapi header, including null termination.

Fixes: 0153094d03df ("liveupdate: luo_session: add sessions support")
Cc: stable@vger.kernel.org

Signed-off-by: Luca Boccassi 
Reviewed-by: Pasha Tatashin 
Reviewed-by: Pratyush Yadav 
Acked-by: Mike Rapoport (Microsoft) 
Link: https://lore.kernel.org/r/20260429212221.814107-2-luca.boccassi@gmail.com
Signed-off-by: Pasha Tatashin 
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Greg Kroah-Hartman

kho: fix order calculation for kho_unpreserve_pages()

2026-05-26T08:01:49+00:00

Commit 91e74fa8b1bc ("kho: make sure preservations do not span multiple
NUMA nodes") made sure preservations from kho_preserve_pages() do not
span multiple NUMA nodes. If they do, the order is reduced and tried
again.

The same logic was not implemented for kho_unpreserve_pages(). This can
result in unpreserve calculating a different order than preserve, and
thus not actually unpreserving the pages.

Fix this by moving the order calculation logic to
__kho_preserve_pages_order() and use it from both preserve and
unpreserve paths.

Move __kho_unpreserve() down to avoid having a forward declaration. Its
users are further down in the file anyway. Also, it results in grouping
for all the page-level preservation and unpreservation functions. This
unfortunately makes the diff hard to read, but the main change in
__kho_unpreserve() is to call __kho_preserve_pages_order() instead of
open-coding the order calculation.

Fixes: 91e74fa8b1bc ("kho: make sure preservations do not span multiple NUMA nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Pratyush Yadav (Google) 
Reviewed-by: Samiullah Khawaja 
Reviewed-by: Pasha Tatashin 
Link: https://patch.msgid.link/20260519133332.2498092-1-pratyush@kernel.org
Signed-off-by: Mike Rapoport (Microsoft)

Merge tag 'fixes-2026-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux

2026-05-13T15:24:50+00:00

Pull liveupdate fixes from Mike Rapoport:
 "A few fixes for kexec handover and liveupdate:

   - make sure KHO is skipped for crash kernel

   - fix error reporting in memfd preservation if it fails mid-loop

   - don't allow preserving memfds whose page count exceeds UINT_MAX

   - fix documentation of memfd seals preservation to match the code"

* tag 'fixes-2026-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
  mm/memfd_luo: document preservation of file seals
  mm/memfd_luo: reject memfds whose page count exceeds UINT_MAX
  mm/memfd_luo: report error when restoring a folio fails mid-loop
  kho: skip KHO for crash kernel