liveupdate: validate session type before performing operation

The sessions ioctls are not applicable to all session types. PRESERVE_FD
is only applicable to outgoing sessions. RETRIEVE_FD and FINISH are only
valid for incoming session. Calling a incoming ioctl on an outgoing
session is invalid and can cause file handlers to run into unexpected
errors.

For example, a user can create a (outgoing) session, preserve a memfd,
and then immediately do a retrieve without doing a kexec in between.
This would result in memfd's retrieve handler to run. The handlers
expects to be called from a post-kexec context, and will try to do a
kho_restore_vmalloc() or kho_restore_folio() to try and restore memory.

KHO catches this (thanks to KHO_PAGE_MAGIC) and returns an error, but
since this is considered an internal error and KHO throws out a bunch of
WARN()s.

Associate a type with each ioctl op and validate the type in
luo_session_ioctl() before dispatching the ioctl handler to make sure
the op is being called for the right session type.

Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation")
Cc: stable@vger.kernel.org
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Link: https://patch.msgid.link/20260519122428.2378446-1-pratyush@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index e7f27815c051722b35e76d6312d5589a57574f76..099db679bdc5335b1278c9aed795738043f38ebf 100644 (file)
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -309,34 +309,60 @@ union ucmd_buffer {
        struct liveupdate_session_get_name get_name;
 };
 
+/* Type of sessions the ioctl applies to. */
+enum luo_ioctl_type {
+       LUO_IOCTL_INCOMING,
+       LUO_IOCTL_OUTGOING,
+       LUO_IOCTL_ALL,
+};
+
 struct luo_ioctl_op {
        unsigned int size;
        unsigned int min_size;
        unsigned int ioctl_num;
+       enum luo_ioctl_type type;
        int (*execute)(struct luo_session *session, struct luo_ucmd *ucmd);
 };
 
-#define IOCTL_OP(_ioctl, _fn, _struct, _last)                                  \
+#define IOCTL_OP(_ioctl, _fn, _struct, _last, _type)                           \
        [_IOC_NR(_ioctl) - LIVEUPDATE_CMD_SESSION_BASE] = {                    \
                .size = sizeof(_struct) +                                      \
                        BUILD_BUG_ON_ZERO(sizeof(union ucmd_buffer) <          \
                                          sizeof(_struct)),                    \
                .min_size = offsetofend(_struct, _last),                       \
                .ioctl_num = _ioctl,                                           \
+               .type = _type,                                                 \
                .execute = _fn,                                                \
        }
 
 static const struct luo_ioctl_op luo_session_ioctl_ops[] = {
        IOCTL_OP(LIVEUPDATE_SESSION_FINISH, luo_session_finish,
-                struct liveupdate_session_finish, reserved),
+                struct liveupdate_session_finish, reserved, LUO_IOCTL_INCOMING),
        IOCTL_OP(LIVEUPDATE_SESSION_PRESERVE_FD, luo_session_preserve_fd,
-                struct liveupdate_session_preserve_fd, token),
+                struct liveupdate_session_preserve_fd, token, LUO_IOCTL_OUTGOING),
        IOCTL_OP(LIVEUPDATE_SESSION_RETRIEVE_FD, luo_session_retrieve_fd,
-                struct liveupdate_session_retrieve_fd, token),
+                struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_INCOMING),
        IOCTL_OP(LIVEUPDATE_SESSION_GET_NAME, luo_session_get_name,
-                struct liveupdate_session_get_name, name),
+                struct liveupdate_session_retrieve_fd, token, LUO_IOCTL_ALL),
 };
 
+static bool luo_ioctl_type_valid(struct luo_session *session,
+                                const struct luo_ioctl_op *op)
+{
+       switch (op->type) {
+       case LUO_IOCTL_INCOMING:
+               /* Retrieved is only set on incoming sessions */
+               return session->retrieved;
+       case LUO_IOCTL_OUTGOING:
+               return !session->retrieved;
+       case LUO_IOCTL_ALL:
+               return true;
+       }
+
+       /* Catch-all. */
+       return false;
+}
+
 static long luo_session_ioctl(struct file *filep, unsigned int cmd,
                              unsigned long arg)
 {
@@ -361,6 +387,8 @@ static long luo_session_ioctl(struct file *filep, unsigned int cmd,
        op = &luo_session_ioctl_ops[nr - LIVEUPDATE_CMD_SESSION_BASE];
        if (op->ioctl_num != cmd)
                return -ENOIOCTLCMD;
+       if (!luo_ioctl_type_valid(session, op))
+               return -EINVAL;
        if (ucmd.user_size < op->min_size)
                return -EINVAL;
 
@@ -631,4 +659,3 @@ err_undo:
 
        return err;
 }
-