Pratyush Yadav 89a3ecca49 kho: make sure page being restored is actually from KHO ...

When restoring a page, no sanity checks are done to make sure the page
actually came from a kexec handover.  The caller is trusted to pass in the
right address.  If the caller has a bug and passes in a wrong address, an
in-use page might be "restored" and returned, causing all sorts of memory
corruption.

Harden the page restore logic by stashing in a magic number in
page->private along with the order.  If the magic number does not match,
the page won't be touched.  page->private is an unsigned long.  The union
kho_page_info splits it into two parts, with one holding the order and the
other holding the magic number.

Link: https://lkml.kernel.org/r/20250917125725.665-2-pratyush@kernel.org
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
Cc: Alexander Graf <graf@amazon.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Changyuan Lyu <changyuanl@google.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Jason Gunthorpe <jgg@nvidia.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

2025-09-23 14:14:17 -07:00

..

bpf

…

cgroup

…

configs

…

debug

…

dma

…

entry

…

events

…

futex

…

gcov

…

irq

…

kcsan

…

livepatch

…

locking

…

module

…

power

…

printk

…

rcu

…

sched

…

time

…

trace

…

unwind

…

.gitignore

…

acct.c

…

async.c

…

audit_fsnotify.c

…

audit_tree.c

…

audit_watch.c

…

audit.c

…

audit.h

…

auditfilter.c

…

auditsc.c

…

backtracetest.c

…

bounds.c

…

capability.c

…

cfi.c

…

compat.c

…

configs.c

…

context_tracking.c

…

cpu_pm.c

…

cpu.c

…

crash_core.c

…

crash_dump_dm_crypt.c

…

crash_reserve.c

…

cred.c

…

delayacct.c

…

dma.c

…

elfcorehdr.c

…

exec_domain.c

…

exit.c

…

exit.h

…

extable.c

…

fail_function.c

…

fork.c

…

freezer.c

…

gen_kheaders.sh

…

groups.c

…

hung_task.c

…

iomem.c

…

irq_work.c

…

jump_label.c

…

kallsyms_internal.h

…

kallsyms_selftest.c

…

kallsyms_selftest.h

…

kallsyms.c

…

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.kexec

…

Kconfig.locks

…

Kconfig.preempt

…

kcov.c

…

kexec_core.c

…

kexec_elf.c

…

kexec_file.c

…

kexec_handover.c

kho: make sure page being restored is actually from KHO

2025-09-23 14:14:17 -07:00

kexec_internal.h

…

kexec.c

…

kheaders.c

…

kprobes.c

…

kstack_erase.c

…

ksyms_common.c

…

ksysfs.c

…

kthread.c

…

latencytop.c

…

Makefile

…

module_signature.c

…

notifier.c

…

nsproxy.c

…

padata.c

…

panic.c

…

params.c

…

pid_namespace.c

…

pid_sysctl.h

…

pid.c

…

profile.c

…

ptrace.c

…

range.c

…

reboot.c

…

regset.c

…

relay.c

…

resource_kunit.c

…

resource.c

…

rseq.c

…

scftorture.c

…

scs.c

…

seccomp.c

…

signal.c

…

smp.c

…

smpboot.c

…

smpboot.h

…

softirq.c

…

stacktrace.c

…

static_call_inline.c

…

static_call.c

…

stop_machine.c

…

sys_ni.c

…

sys.c

…

sysctl-test.c

…

sysctl.c

…

task_work.c

…

taskstats.c

…

torture.c

…

tracepoint.c

…

tsacct.c

…

ucount.c

…

uid16.c

…

uid16.h

…

umh.c

…

up.c

…

user_namespace.c

…

user-return-notifier.c

…

user.c

…

utsname_sysctl.c

…

utsname.c

…

vhost_task.c

…

vmcore_info.c

…

watch_queue.c

…

watchdog_buddy.c

…

watchdog_perf.c

…

watchdog.c

…

workqueue_internal.h

…

workqueue.c

…