linux.git/kernel/liveupdate/luo_file.c, branch v7.2-rc2

liveupdate: Remove limit on the number of files per session

2026-06-03T18:15:46+00:00

To remove the fixed limit on the number of preserved files per session,
transition the file metadata serialization from a single contiguous
memory block to a chain of linked blocks.

Acked-by: Mike Rapoport (Microsoft) 
Reviewed-by: Pratyush Yadav (Google) 
Signed-off-by: Pasha Tatashin 
Link: https://patch.msgid.link/20260603154402.468928-11-pasha.tatashin@soleen.com
Signed-off-by: Mike Rapoport (Microsoft)

liveupdate: Extract luo_file_deserialize_one helper

2026-06-03T18:15:46+00:00

Extract the logic for deserializing single entries for files into
separate helper functions. In preparation to a linked-block
serialization for files.

This is a pure code movement, no other changes intended.

Acked-by: Mike Rapoport (Microsoft) 
Reviewed-by: Pratyush Yadav (Google) 
Signed-off-by: Pasha Tatashin 
Link: https://patch.msgid.link/20260603154402.468928-6-pasha.tatashin@soleen.com
Signed-off-by: Mike Rapoport (Microsoft)

liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()

2026-06-01T06:19:38+00:00

In luo_file_unpreserve_files() and luo_file_finish(), reorder
module_put() and xa_erase() to ensure the file handler module remains
pinned while its operations are being accessed.

Specifically, luo_get_id() dereferences fh->ops->get_id, so the module
reference must be held until after xa_erase() (which calls luo_get_id)
completes.

For luo_file_finish(), this requires moving the module_put() call out of
the luo_file_finish_one() helper and into the main loop of
luo_file_finish() itself.

Fixes: 00d0b372374f ("liveupdate: prevent double management of files")
Acked-by: Mike Rapoport (Microsoft) 
Reviewed-by: Pratyush Yadav (Google) 
Signed-off-by: Pasha Tatashin 
Link: https://patch.msgid.link/20260527202737.1345192-5-pasha.tatashin@soleen.com
Signed-off-by: Mike Rapoport (Microsoft)

liveupdate: defer file handler module refcounting to active sessions

2026-04-18T07:10:50+00:00

Stop pinning modules indefinitely upon file handler registration. 
Instead, dynamically increment the module reference count only when a live
update session actively uses the file handler (e.g., during preservation
or deserialization), and release it when the session ends.

This allows modules providing live update handlers to be gracefully
unloaded when no live update is in progress.

Link: https://lore.kernel.org/20260327033335.696621-11-pasha.tatashin@soleen.com
Signed-off-by: Pasha Tatashin 
Reviewed-by: Pratyush Yadav (Google) 
Cc: David Matlack 
Cc: Mike Rapoport 
Cc: Samiullah Khawaja 
Signed-off-by: Andrew Morton

liveupdate: make unregister functions return void

2026-04-18T07:10:50+00:00

Change liveupdate_unregister_file_handler and liveupdate_unregister_flb to
return void instead of an error code.  This follows the design principle
that unregistration during module unload should not fail, as the unload
cannot be stopped at that point.

Link: https://lore.kernel.org/20260327033335.696621-10-pasha.tatashin@soleen.com
Signed-off-by: Pasha Tatashin 
Reviewed-by: Pratyush Yadav (Google) 
Cc: David Matlack 
Cc: Mike Rapoport 
Cc: Samiullah Khawaja 
Signed-off-by: Andrew Morton

liveupdate: remove liveupdate_test_unregister()

2026-04-18T07:10:50+00:00

Now that file handler unregistration automatically unregisters all
associated file handlers (FLBs), the liveupdate_test_unregister() function
is no longer needed.  Remove it along with its usages and declarations.

Link: https://lore.kernel.org/20260327033335.696621-9-pasha.tatashin@soleen.com
Signed-off-by: Pasha Tatashin 
Reviewed-by: Pratyush Yadav (Google) 
Cc: David Matlack 
Cc: Mike Rapoport 
Cc: Samiullah Khawaja 
Signed-off-by: Andrew Morton

liveupdate: auto unregister FLBs on file handler unregistration

2026-04-18T07:10:50+00:00

To ensure that unregistration is always successful and doesn't leave
dangling resources, introduce auto-unregistration of FLBs: when a file
handler is unregistered, all FLBs associated with it are automatically
unregistered.

Introduce a new helper luo_flb_unregister_all() which unregisters all FLBs
linked to the given file handler.

Link: https://lore.kernel.org/20260327033335.696621-8-pasha.tatashin@soleen.com
Signed-off-by: Pasha Tatashin 
Reviewed-by: Pratyush Yadav (Google) 
Cc: David Matlack 
Cc: Mike Rapoport 
Cc: Samiullah Khawaja 
Signed-off-by: Andrew Morton

liveupdate: remove luo_session_quiesce()

2026-04-18T07:10:50+00:00

Now that FLB module references are handled dynamically during active
sessions, we can safely remove the luo_session_quiesce() and
luo_session_resume() mechanism.

Link: https://lore.kernel.org/20260327033335.696621-7-pasha.tatashin@soleen.com
Signed-off-by: Pasha Tatashin 
Reviewed-by: Pratyush Yadav (Google) 
Cc: David Matlack 
Cc: Mike Rapoport 
Cc: Samiullah Khawaja 
Signed-off-by: Andrew Morton

liveupdate: protect file handler list with rwsem

2026-04-18T07:10:49+00:00

Because liveupdate file handlers will no longer hold a module reference
when registered, we must ensure that the access to the handler list is
protected against concurrent module unloading.

Utilize the global luo_register_rwlock to protect the global registry of
file handlers.  Read locks are taken during list traversals in
luo_preserve_file() and luo_file_deserialize().  Write locks are taken
during registration and unregistration.

Link: https://lore.kernel.org/20260327033335.696621-4-pasha.tatashin@soleen.com
Signed-off-by: Pasha Tatashin 
Reviewed-by: Pratyush Yadav (Google) 
Cc: David Matlack 
Cc: Mike Rapoport 
Cc: Samiullah Khawaja 
Signed-off-by: Andrew Morton

liveupdate: safely print untrusted strings

2026-04-18T07:10:49+00:00

Patch series "liveupdate: Fix module unloading and unregister API", v3.

This patch series addresses an issue with how LUO handles module reference
counting and unregistration during a module unload (e.g., via rmmod).

Currently, modules that register live update file handlers are pinned for
the entire duration they are registered.  This prevents the modules from
being unloaded gracefully, even when no live update session is in
progress.

Furthermore, if a module is forcefully unloaded, the unregistration
functions return an error (e.g.  -EBUSY) if a session is active, which is
ignored by the kernel's module unload path, leaving dangling pointers in
the LUO global lists.

To resolve these issues, this series introduces the following changes:
1. Adds a global read-write semaphore (luo_register_rwlock) to protect
   the registration lists for both file handlers and FLBs.
2. Reduces the scope of module reference counting for file handlers and
   FLBs. Instead of pinning modules indefinitely upon registration,
   references are now taken only when they are actively used in a live
   update session (e.g., during preservation, retrieval, or
   deserialization).
3. Removes the global luo_session_quiesce() mechanism since module
   unload behavior now handles active sessions implicitly.
4. Introduces auto-unregistration of FLBs during file handler
   unregistration to prevent leaving dangling resources.
5. Changes the unregistration functions to return void instead of
   an error code.
6. Fixes a data race in luo_flb_get_private() by introducing a spinlock
   for thread-safe lazy initialization.
7. Strengthens security by using %.*s when printing untrusted deserialized
   compatible strings and session names to prevent out-of-bounds reads.


This patch (of 10):

Deserialized strings from KHO data (such as file handler compatible
strings and session names) are provided by the previous kernel and might
not be null-terminated if the data is corrupted or maliciously crafted.

When printing these strings in error messages, use the %.*s format
specifier with the maximum buffer size to prevent out-of-bounds reads into
adjacent kernel memory.

Link: https://lore.kernel.org/20260327033335.696621-1-pasha.tatashin@soleen.com
Link: https://lore.kernel.org/20260327033335.696621-2-pasha.tatashin@soleen.com
Signed-off-by: Pasha Tatashin 
Reviewed-by: Pratyush Yadav (Google) 
Cc: David Matlack 
Cc: Mike Rapoport 
Cc: Samiullah Khawaja 
Signed-off-by: Andrew Morton