tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

kho: make sure page being restored is actually from KHO

When restoring a page, no sanity checks are done to make sure the page
actually came from a kexec handover. The caller is trusted to pass in the
right address. If the caller has a bug and passes in a wrong address, an
in-use page might be "restored" and returned, causing all sorts of memory
corruption.

Harden the page restore logic by stashing in a magic number in
page->private along with the order. If the magic number does not match,
the page won't be touched. page->private is an unsigned long. The union
kho_page_info splits it into two parts, with one holding the order and the
other holding the magic number.

Link: https://lkml.kernel.org/r/20250917125725.665-2-pratyush@kernel.org
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
Cc: Alexander Graf <graf@amazon.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Changyuan Lyu <changyuanl@google.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Jason Gunthorpe <jgg@nvidia.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Pratyush Yadav and committed by
Andrew Morton 89a3ecca 20571b18

+34 -7
+34 -7
kernel/kexec_handover.c
··· 32 32 #define PROP_PRESERVED_MEMORY_MAP "preserved-memory-map" 33 33 #define PROP_SUB_FDT "fdt" 34 34 35 + #define KHO_PAGE_MAGIC 0x4b484f50U /* ASCII for 'KHOP' */ 36 + 37 + /* 38 + * KHO uses page->private, which is an unsigned long, to store page metadata. 39 + * Use it to store both the magic and the order. 40 + */ 41 + union kho_page_info { 42 + unsigned long page_private; 43 + struct { 44 + unsigned int order; 45 + unsigned int magic; 46 + }; 47 + }; 48 + 49 + static_assert(sizeof(union kho_page_info) == sizeof(((struct page *)0)->private)); 50 + 35 51 static bool kho_enable __ro_after_init; 36 52 37 53 bool kho_is_enabled(void) ··· 202 186 static struct page *kho_restore_page(phys_addr_t phys) 203 187 { 204 188 struct page *page = pfn_to_online_page(PHYS_PFN(phys)); 205 - unsigned int nr_pages, order; 189 + union kho_page_info info; 190 + unsigned int nr_pages; 206 191 207 192 if (!page) 208 193 return NULL; 209 194 210 - order = page->private; 211 - if (order > MAX_PAGE_ORDER) 195 + info.page_private = page->private; 196 + /* 197 + * deserialize_bitmap() only sets the magic on the head page. This magic 198 + * check also implicitly makes sure phys is order-aligned since for 199 + * non-order-aligned phys addresses, magic will never be set. 200 + */ 201 + if (WARN_ON_ONCE(info.magic != KHO_PAGE_MAGIC || info.order > MAX_PAGE_ORDER)) 212 202 return NULL; 213 - nr_pages = (1 << order); 203 + nr_pages = (1 << info.order); 214 204 205 + /* Clear private to make sure later restores on this page error out. */ 206 + page->private = 0; 215 207 /* Head page gets refcount of 1. */ 216 208 set_page_count(page, 1); 217 209 ··· 227 203 for (unsigned int i = 1; i < nr_pages; i++) 228 204 set_page_count(page + i, 0); 229 205 230 - if (order > 0) 231 - prep_compound_page(page, order); 206 + if (info.order > 0) 207 + prep_compound_page(page, info.order); 232 208 233 209 adjust_managed_page_count(page, nr_pages); 234 210 return page; ··· 365 341 phys_addr_t phys = 366 342 elm->phys_start + (bit << (order + PAGE_SHIFT)); 367 343 struct page *page = phys_to_page(phys); 344 + union kho_page_info info; 368 345 369 346 memblock_reserve(phys, sz); 370 347 memblock_reserved_mark_noinit(phys, sz); 371 - page->private = order; 348 + info.magic = KHO_PAGE_MAGIC; 349 + info.order = order; 350 + page->private = info.page_private; 372 351 } 373 352 } 374 353