kho: validate preserved memory map during population

If the previous kernel enabled KHO but did not call kho_finalize() (e.g.,
CONFIG_LIVEUPDATE=n or userspace skipped the finalization step), the
'preserved-memory-map' property in the FDT remains empty/zero.

Previously, kho_populate() would succeed regardless of the memory map's
state, reserving the incoming scratch regions in memblock.  However,
kho_memory_init() would later fail to deserialize the empty map.  By that
time, the scratch regions were already registered, leading to partial
initialization and subsequent list corruption (freeing scratch area twice)
during kho_init().

Move the validation of the preserved memory map earlier into
kho_populate(). If the memory map is empty/NULL:
1. Abort kho_populate() immediately with -ENOENT.
2. Do not register or reserve the incoming scratch memory, allowing the new
   kernel to reclaim those pages as standard free memory.
3. Leave the global 'kho_in' state uninitialized.

Consequently, kho_memory_init() sees no active KHO context
(kho_in.mem_chunks_phys is 0) and falls back to kho_reserve_scratch(),
allocating fresh scratch memory as if it were a standard cold boot.

Link: https://lkml.kernel.org/r/20251223140140.2090337-1-pasha.tatashin@soleen.com
Fixes: de51999e687c ("kho: allow memory preservation state updates after finalization")
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reported-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Closes: https://lore.kernel.org/all/20251218215613.GA17304@ranerica-svr.sc.intel.com
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Tested-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Cc: Alexander Graf <graf@amazon.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
index 9dc51fab604f11bcb9ae68bffd500e5c7b8816b6..d4482b6e3cae393f3517e0aa916a759d6487d05f 100644 (file)
--- a/kernel/liveupdate/kexec_handover.c
+++ b/kernel/liveupdate/kexec_handover.c
@@ -460,27 +460,23 @@ static void __init deserialize_bitmap(unsigned int order,
        }
 }
 
-/* Return true if memory was deserizlied */
-static bool __init kho_mem_deserialize(const void *fdt)
+/* Returns physical address of the preserved memory map from FDT */
+static phys_addr_t __init kho_get_mem_map_phys(const void *fdt)
 {
-       struct khoser_mem_chunk *chunk;
        const void *mem_ptr;
-       u64 mem;
        int len;
 
        mem_ptr = fdt_getprop(fdt, 0, PROP_PRESERVED_MEMORY_MAP, &len);
        if (!mem_ptr || len != sizeof(u64)) {
                pr_err("failed to get preserved memory bitmaps\n");
-               return false;
+               return 0;
        }
 
-       mem = get_unaligned((const u64 *)mem_ptr);
-       chunk = mem ? phys_to_virt(mem) : NULL;
-
-       /* No preserved physical pages were passed, no deserialization */
-       if (!chunk)
-               return false;
+       return get_unaligned((const u64 *)mem_ptr);
+}
 
+static void __init kho_mem_deserialize(struct khoser_mem_chunk *chunk)
+{
        while (chunk) {
                unsigned int i;
 
@@ -489,8 +485,6 @@ static bool __init kho_mem_deserialize(const void *fdt)
                                           &chunk->bitmaps[i]);
                chunk = KHOSER_LOAD_PTR(chunk->hdr.next);
        }
-
-       return true;
 }
 
 /*
@@ -1253,6 +1247,7 @@ bool kho_finalized(void)
 struct kho_in {
        phys_addr_t fdt_phys;
        phys_addr_t scratch_phys;
+       phys_addr_t mem_map_phys;
        struct kho_debugfs dbg;
 };
 
@@ -1434,12 +1429,10 @@ static void __init kho_release_scratch(void)
 
 void __init kho_memory_init(void)
 {
-       if (kho_in.scratch_phys) {
+       if (kho_in.mem_map_phys) {
                kho_scratch = phys_to_virt(kho_in.scratch_phys);
                kho_release_scratch();
-
-               if (!kho_mem_deserialize(kho_get_fdt()))
-                       kho_in.fdt_phys = 0;
+               kho_mem_deserialize(phys_to_virt(kho_in.mem_map_phys));
        } else {
                kho_reserve_scratch();
        }
@@ -1448,8 +1441,9 @@ void __init kho_memory_init(void)
 void __init kho_populate(phys_addr_t fdt_phys, u64 fdt_len,
                         phys_addr_t scratch_phys, u64 scratch_len)
 {
-       void *fdt = NULL;
        struct kho_scratch *scratch = NULL;
+       phys_addr_t mem_map_phys;
+       void *fdt = NULL;
        int err = 0;
        unsigned int scratch_cnt = scratch_len / sizeof(*kho_scratch);
 
@@ -1475,6 +1469,12 @@ void __init kho_populate(phys_addr_t fdt_phys, u64 fdt_len,
                goto out;
        }
 
+       mem_map_phys = kho_get_mem_map_phys(fdt);
+       if (!mem_map_phys) {
+               err = -ENOENT;
+               goto out;
+       }
+
        scratch = early_memremap(scratch_phys, scratch_len);
        if (!scratch) {
                pr_warn("setup: failed to memremap scratch (phys=0x%llx, len=%lld)\n",
@@ -1515,6 +1515,7 @@ void __init kho_populate(phys_addr_t fdt_phys, u64 fdt_len,
 
        kho_in.fdt_phys = fdt_phys;
        kho_in.scratch_phys = scratch_phys;
+       kho_in.mem_map_phys = mem_map_phys;
        kho_scratch_cnt = scratch_cnt;
        pr_info("found kexec handover data.\n");