[PATCH v2 0/2] liveupdate: fix incoming error handling and teardown paths

[PATCH v2 0/2] liveupdate: fix incoming error handling and teardown paths

[Leo Timmins]

Hi,

This series fixes two issues in LUO's incoming-side error handling and
teardown paths.

The first patch makes session deserialization fail when file
deserialization fails, instead of silently continuing with a partially
restored session.

The second patch (formerly patch 3 on the v1) initializes incoming FLB
state before the finish pathdecrements its refcount, so the last-user
cleanup path does not run from an uninitialized count. (and now 
utilises pr_warn instead of WARN_ON)

Changes in v2:

  - drop the previous patch 2 after review
  - patch 2/2: replace WARN_ON(err) with pr_warn() in
    luo_flb_file_finish_one()

Leo Timmins (2):
  liveupdate: propagate file deserialization failures
  liveupdate: initialize incoming FLB state before finish

 kernel/liveupdate/luo_flb.c     | 19 ++++++++++++++++++-
 kernel/liveupdate/luo_session.c |  9 +++++++--
 2 files changed, 25 insertions(+), 3 deletions(-)


base-commit: e3c33bc767b5512dbfec643a02abf58ce608f3b2
-- 
2.53.0

[PATCH v2 1/2] liveupdate: propagate file deserialization failures

[Leo Timmins]

luo_session_deserialize() ignored the return value from
luo_file_deserialize(). As a result, a session could be left partially
restored even though the /dev/liveupdate open path treats deserialization
failures as fatal.

Propagate the error so a failed file deserialization aborts session
deserialization instead of silently continuing.

Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation")

Signed-off-by: Leo Timmins <leotimmins1974@gmail.com>
---
 kernel/liveupdate/luo_session.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
index 783677295640..25ae704d7787 100644
--- a/kernel/liveupdate/luo_session.c
+++ b/kernel/liveupdate/luo_session.c
@@ -558,8 +558,13 @@ int luo_session_deserialize(void)
 		}
 
 		scoped_guard(mutex, &session->mutex) {
-			luo_file_deserialize(&session->file_set,
-					     &sh->ser[i].file_set_ser);
+			err = luo_file_deserialize(&session->file_set,
+						   &sh->ser[i].file_set_ser);
+		}
+		if (err) {
+			pr_warn("Failed to deserialize files for session [%s] %pe\n",
+				session->name, ERR_PTR(err));
+			return err;
 		}
 	}
 
-- 
2.53.0

Re: [PATCH v2 1/2] liveupdate: propagate file deserialization failures

[Pasha Tatashin]

On Wed, Mar 25, 2026 at 12:46 AM Leo Timmins <leotimmins1974@gmail.com> wrote:
>
> luo_session_deserialize() ignored the return value from
> luo_file_deserialize(). As a result, a session could be left partially
> restored even though the /dev/liveupdate open path treats deserialization
> failures as fatal.
>
> Propagate the error so a failed file deserialization aborts session
> deserialization instead of silently continuing.
>
> Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation")
>
> Signed-off-by: Leo Timmins <leotimmins1974@gmail.com>

Please preserve the tags.

Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>

> ---
>  kernel/liveupdate/luo_session.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
> index 783677295640..25ae704d7787 100644
> --- a/kernel/liveupdate/luo_session.c
> +++ b/kernel/liveupdate/luo_session.c
> @@ -558,8 +558,13 @@ int luo_session_deserialize(void)
>                 }
>
>                 scoped_guard(mutex, &session->mutex) {
> -                       luo_file_deserialize(&session->file_set,
> -                                            &sh->ser[i].file_set_ser);
> +                       err = luo_file_deserialize(&session->file_set,
> +                                                  &sh->ser[i].file_set_ser);
> +               }
> +               if (err) {
> +                       pr_warn("Failed to deserialize files for session [%s] %pe\n",
> +                               session->name, ERR_PTR(err));
> +                       return err;
>                 }
>         }
>
> --
> 2.53.0
>

Re: [PATCH v2 1/2] liveupdate: propagate file deserialization failures

[Andrew Morton]

On Wed, 25 Mar 2026 12:46:07 +0800 Leo Timmins <leotimmins1974@gmail.com> wrote:

> luo_session_deserialize() ignored the return value from
> luo_file_deserialize(). As a result, a session could be left partially
> restored even though the /dev/liveupdate open path treats deserialization
> failures as fatal.
> 
> Propagate the error so a failed file deserialization aborts session
> deserialization instead of silently continuing.
> 
> Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation")

Present in 6.19.  Is this serious enough for a -stable backport?

Leo, I'll add this to mm.git's mm-hotfixes branch because "fix". 
Please do send along a v2 which addresses Pasha's comments.

[PATCH v2 2/2] liveupdate: initialize incoming FLB state before finish

[Leo Timmins]

luo_flb_file_finish_one() decremented incoming.count before making sure
that the incoming FLB state had been materialized. If no earlier incoming
retrieval had populated that state, the first decrement ran from zero and
skipped the last-user finish path.

Initialize the incoming FLB state before the first decrement so finish
uses the serialized refcount instead of an uninitialized value.

v2 - now uses pr_warn instead of WARN_ON

Fixes: cab056f2aae7 ("liveupdate: luo_flb: introduce File-Lifecycle-Bound global state")

Signed-off-by: Leo Timmins <leotimmins1974@gmail.com>
---
 kernel/liveupdate/luo_flb.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/kernel/liveupdate/luo_flb.c b/kernel/liveupdate/luo_flb.c
index f52e8114837e..855af655b09b 100644
--- a/kernel/liveupdate/luo_flb.c
+++ b/kernel/liveupdate/luo_flb.c
@@ -192,10 +192,27 @@ static int luo_flb_retrieve_one(struct liveupdate_flb *flb)
 static void luo_flb_file_finish_one(struct liveupdate_flb *flb)
 {
 	struct luo_flb_private *private = luo_flb_get_private(flb);
+	bool needs_retrieve = false;
 	u64 count;
 
-	scoped_guard(mutex, &private->incoming.lock)
+	scoped_guard(mutex, &private->incoming.lock) {
+		if (!private->incoming.count && !private->incoming.finished)
+			needs_retrieve = true;
+	}
+
+	if (needs_retrieve) {
+		int err = luo_flb_retrieve_one(flb);
+
+		if (err) {
+			pr_warn("Failed to retrieve FLB '%s' during finish: %pe\n",
+				flb->compatible, ERR_PTR(err));
+			return;
+		}
+	}
+
+	scoped_guard(mutex, &private->incoming.lock) {
 		count = --private->incoming.count;
+	}
 
 	if (!count) {
 		struct liveupdate_flb_op_args args = {0};
-- 
2.53.0

Re: [PATCH v2 2/2] liveupdate: initialize incoming FLB state before finish

[Pasha Tatashin]

On Wed, Mar 25, 2026 at 12:46 AM Leo Timmins <leotimmins1974@gmail.com> wrote:
>
> luo_flb_file_finish_one() decremented incoming.count before making sure
> that the incoming FLB state had been materialized. If no earlier incoming
> retrieval had populated that state, the first decrement ran from zero and
> skipped the last-user finish path.
>
> Initialize the incoming FLB state before the first decrement so finish
> uses the serialized refcount instead of an uninitialized value.
>
> v2 - now uses pr_warn instead of WARN_ON
>
> Fixes: cab056f2aae7 ("liveupdate: luo_flb: introduce File-Lifecycle-Bound global state")
>
> Signed-off-by: Leo Timmins <leotimmins1974@gmail.com>
> ---
>  kernel/liveupdate/luo_flb.c | 19 ++++++++++++++++++-
>  1 file changed, 18 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/liveupdate/luo_flb.c b/kernel/liveupdate/luo_flb.c
> index f52e8114837e..855af655b09b 100644
> --- a/kernel/liveupdate/luo_flb.c
> +++ b/kernel/liveupdate/luo_flb.c
> @@ -192,10 +192,27 @@ static int luo_flb_retrieve_one(struct liveupdate_flb *flb)
>  static void luo_flb_file_finish_one(struct liveupdate_flb *flb)
>  {
>         struct luo_flb_private *private = luo_flb_get_private(flb);
> +       bool needs_retrieve = false;
>         u64 count;
>
> -       scoped_guard(mutex, &private->incoming.lock)
> +       scoped_guard(mutex, &private->incoming.lock) {
> +               if (!private->incoming.count && !private->incoming.finished)
> +                       needs_retrieve = true;
> +       }
> +
> +       if (needs_retrieve) {
> +               int err = luo_flb_retrieve_one(flb);
> +
> +               if (err) {
> +                       pr_warn("Failed to retrieve FLB '%s' during finish: %pe\n",
> +                               flb->compatible, ERR_PTR(err));
> +                       return;
> +               }
> +       }
> +
> +       scoped_guard(mutex, &private->incoming.lock) {
>                 count = --private->incoming.count;
> +       }

Delta would be two lines smaller if you did not add braces to this one
line scope.

With that,
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>

Pasha

>
>         if (!count) {
>                 struct liveupdate_flb_op_args args = {0};
> --
> 2.53.0
>