[PATCH 4/5] liveupdate: validate handover metadata before using it
Oskar Gerlicz Kowalczuk
oskar at gerlicz.space
Fri Mar 20 09:37:19 PDT 2026
The handover restore path currently trusts counts, strings and
addresses copied from the previous kernel. A truncated or corrupted
handover can feed invalid header addresses, oversized counts,
unterminated names or impossible memfd folio layouts straight into
restore code.
That is dangerous because it can turn a bad handover into
out-of-bounds iteration, bogus phys_to_virt() translations or
inconsistent shmem state in the new kernel.
Add cheap sanity checks before consuming the metadata. Validate
session and file counts, require non-zero serialized pointers when
data is present, reject unterminated names, sanity-check FLB headers,
and make memfd_luo reject impossible folio indices and unsupported
flags.
Signed-off-by: Oskar Gerlicz Kowalczuk <oskar at gerlicz.space>
---
kernel/liveupdate/luo_file.c | 19 +++++++++++++++----
kernel/liveupdate/luo_flb.c | 14 ++++++++++++++
kernel/liveupdate/luo_session.c | 16 ++++++++++++++++
mm/memfd_luo.c | 26 ++++++++++++++++++++++++++
4 files changed, 71 insertions(+), 4 deletions(-)
diff --git a/kernel/liveupdate/luo_file.c b/kernel/liveupdate/luo_file.c
index cc0fd7e9c332..94d49255115d 100644
--- a/kernel/liveupdate/luo_file.c
+++ b/kernel/liveupdate/luo_file.c
@@ -765,10 +765,14 @@ int luo_file_deserialize(struct luo_file_set *file_set,
u64 i;
int err;
- if (!file_set_ser->files) {
- WARN_ON(file_set_ser->count);
- return 0;
- }
+ if (!file_set_ser->count)
+ return file_set_ser->files ? -EINVAL : 0;
+
+ if (!file_set_ser->files)
+ return -EINVAL;
+
+ if (file_set_ser->count > LUO_FILE_MAX)
+ return -EINVAL;
file_set->count = file_set_ser->count;
file_set->files = phys_to_virt(file_set_ser->files);
@@ -779,6 +783,13 @@ int luo_file_deserialize(struct luo_file_set *file_set,
bool handler_found = false;
struct luo_file *luo_file;
+ if (strnlen(file_ser[i].compatible,
+ sizeof(file_ser[i].compatible)) ==
+ sizeof(file_ser[i].compatible)) {
+ err = -EINVAL;
+ goto err_discard;
+ }
+
list_private_for_each_entry(fh, &luo_file_handler_list, list) {
if (!strcmp(fh->compatible, file_ser[i].compatible)) {
handler_found = true;
diff --git a/kernel/liveupdate/luo_flb.c b/kernel/liveupdate/luo_flb.c
index f52e8114837e..3672cbf8e075 100644
--- a/kernel/liveupdate/luo_flb.c
+++ b/kernel/liveupdate/luo_flb.c
@@ -165,7 +165,14 @@ static int luo_flb_retrieve_one(struct liveupdate_flb *flb)
return -ENODATA;
for (int i = 0; i < fh->header_ser->count; i++) {
+ if (strnlen(fh->ser[i].name, sizeof(fh->ser[i].name)) ==
+ sizeof(fh->ser[i].name))
+ return -EINVAL;
+
if (!strcmp(fh->ser[i].name, flb->compatible)) {
+ if (!fh->ser[i].count)
+ return -EINVAL;
+
private->incoming.data = fh->ser[i].data;
private->incoming.count = fh->ser[i].count;
found = true;
@@ -609,7 +616,14 @@ int __init luo_flb_setup_incoming(void *fdt_in)
}
header_ser_pa = get_unaligned((u64 *)ptr);
+ if (!header_ser_pa) {
+ pr_err("FLB header address is missing\n");
+ return -EINVAL;
+ }
+
header_ser = phys_to_virt(header_ser_pa);
+ if (header_ser->pgcnt != LUO_FLB_PGCNT || header_ser->count > LUO_FLB_MAX)
+ return -EINVAL;
luo_flb_global.incoming.header_ser = header_ser;
luo_flb_global.incoming.ser = (void *)(header_ser + 1);
diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 77afa913d6c7..9a08e9794062 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -542,6 +542,11 @@ int __init luo_session_setup_incoming(void *fdt_in)
}
header_ser_pa = get_unaligned((u64 *)ptr);
+ if (!header_ser_pa) {
+ pr_err("Session header address is missing\n");
+ return -EINVAL;
+ }
+
header_ser = phys_to_virt(header_ser_pa);
luo_session_global.incoming.header_ser = header_ser;
@@ -565,9 +570,20 @@ int luo_session_deserialize(void)
if (!sh->active)
return 0;
+ if (sh->header_ser->count > LUO_SESSION_MAX) {
+ pr_warn("Invalid session count %llu\n", sh->header_ser->count);
+ return -EINVAL;
+ }
+
for (int i = 0; i < sh->header_ser->count; i++) {
struct luo_session *session;
+ if (strnlen(sh->ser[i].name, sizeof(sh->ser[i].name)) ==
+ sizeof(sh->ser[i].name)) {
+ pr_warn("Session name is not NUL-terminated\n");
+ return -EINVAL;
+ }
+
session = luo_session_alloc(sh->ser[i].name);
if (IS_ERR(session)) {
pr_warn("Failed to allocate session [%s] during deserialization %pe\n",
diff --git a/mm/memfd_luo.c b/mm/memfd_luo.c
index b8edb9f981d7..75f3f7226e6e 100644
--- a/mm/memfd_luo.c
+++ b/mm/memfd_luo.c
@@ -394,10 +394,15 @@ static int memfd_luo_retrieve_folios(struct file *file,
{
struct inode *inode = file_inode(file);
struct address_space *mapping = inode->i_mapping;
+ u64 max_index = i_size_read(inode);
+ u64 prev_index = 0;
struct folio *folio;
int err = -EIO;
long i;
+ if (max_index)
+ max_index = (max_index - 1) >> PAGE_SHIFT;
+
for (i = 0; i < nr_folios; i++) {
const struct memfd_luo_folio_ser *pfolio = &folios_ser[i];
phys_addr_t phys;
@@ -407,6 +412,18 @@ static int memfd_luo_retrieve_folios(struct file *file,
if (!pfolio->pfn)
continue;
+ if (pfolio->flags &
+ ~(MEMFD_LUO_FOLIO_DIRTY | MEMFD_LUO_FOLIO_UPTODATE)) {
+ err = -EINVAL;
+ goto put_folios;
+ }
+
+ if (pfolio->index > max_index ||
+ (i && pfolio->index <= prev_index)) {
+ err = -EINVAL;
+ goto put_folios;
+ }
+
phys = PFN_PHYS(pfolio->pfn);
folio = kho_restore_folio(phys);
if (!folio) {
@@ -415,6 +432,7 @@ static int memfd_luo_retrieve_folios(struct file *file,
goto put_folios;
}
index = pfolio->index;
+ prev_index = index;
flags = pfolio->flags;
/* Set up the folio for insertion. */
@@ -486,6 +504,14 @@ static int memfd_luo_retrieve(struct liveupdate_file_op_args *args)
if (!ser)
return -EINVAL;
+ if (!!ser->nr_folios != !!ser->folios.first.phys)
+ return -EINVAL;
+
+ if (ser->nr_folios &&
+ (!ser->size ||
+ ser->nr_folios > ((ser->size - 1) >> PAGE_SHIFT) + 1))
+ return -EINVAL;
+
file = memfd_alloc_file("", 0);
if (IS_ERR(file)) {
pr_err("failed to setup file: %pe\n", file);
--
2.53.0
More information about the kexec
mailing list