From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f46.google.com (mail-qv1-f46.google.com [209.85.219.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D76AC359A97 for ; Fri, 27 Mar 2026 03:33:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774582419; cv=none; b=ci8kIE9lg1yO/YqnFF7Ms122zylqou6aAf87vHGgBsFwHYrW9JI01RrVkVxsnozjlpI/w5YswwpeuP8e3+HYnc9fMxjxiErs4b0jjtiwAkOf2Q+TcEVOHWivCX/B9M12tShGupxsM59pH64FiT3oDzu4WdoT4uLqK5zS5mlJEoE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774582419; c=relaxed/simple; bh=B1PcZbiDuh25zJhdwP7PSPq25+/xHpJS60lT/QDR098=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=O3U8zuk0MA4YxDADoIae7Oa8uMKd0As327IHIbfLacTpYFCQwpHAzq5EabjfCNLKwDK8+hVZxtIWWZcx+pKjgWPCzO+q6mK9bN22nNFOLwpfVGfMLl2B2vKz87Q4HgzRwdDzJe5PiDBBo2LZNduIz98Bu0lqdxuz3WH94dOxelI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=soleen.com; spf=pass smtp.mailfrom=soleen.com; dkim=pass (2048-bit key) header.d=soleen.com header.i=@soleen.com header.b=Cg37w+cj; arc=none smtp.client-ip=209.85.219.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=soleen.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=soleen.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=soleen.com header.i=@soleen.com header.b="Cg37w+cj" Received: by mail-qv1-f46.google.com with SMTP id 6a1803df08f44-89cab686a9bso12275546d6.2 for ; Thu, 26 Mar 2026 20:33:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=soleen.com; s=google; t=1774582416; x=1775187216; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=2mVzEWL0L2HhjVvEK8GmAScGtZLW+i1YPHrNZRQ3Nso=; b=Cg37w+cjXJMFqQwKFWtHGKmXdqQkZusuOg0XzS+4wxGrnsF5fyfiY53K2inU/xD/Is /5fjIzLmSjNEolB0f95nxX2913MxoSbFwWroEKqB9KGsQxQuhDqLrKkEVnUugQa+Btob cn7rkLcuxDuWlzOlyykBfIdCQ0OpuxwN9oeWb5OgR2z1p/incJd1Jr4digwmjyCeQLDD zD4StHF6XtiRfyUjUprLqHHrG1Ob7Xu3H3NjkH+z8Xm8f3YaT/TrNnfVDxKroAt5QiBI dB5QirQkpOx1tL7aSyshWVQaBUMqQ3g6XhQpCyxd6RYhvjL2/M+OfZmtZMiq5AHzmlSQ HPwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774582416; x=1775187216; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=2mVzEWL0L2HhjVvEK8GmAScGtZLW+i1YPHrNZRQ3Nso=; b=j9rEIhVl8JHxWg1d0G+TjqmJKJ7SILNoeVWh6J5Zr1yXU4FwZCy66ICpJUnSdOk0Hn Zt4E32c7Tfb8zmxelaX+3KOrR+362RXyZ47ZQXRUFcRKYb159CCUiU826AXjTHxFBbS6 Mo5rBJynpnryfuQg/XAGVrGdeKXi8Vqb7N5Z+QtCHr8PwMqnnicETJsmD3NBklZ88MKn L2QsWA8QXzxfxDFxDnl9oYg2eMR3ae7/Re9Pv3+l6BG/xIjBiglXnPYK7xvWcaOZSV/t 01ptNtLYw4THzHe21lEjpQVrPK3ouWMTH7tP/iRv5QB1xjlh1t5vmyXLE0KerpaMzk+w l9ow== X-Forwarded-Encrypted: i=1; AJvYcCXskrgAbLg6zZ3QPiSLqAsEDBdyLBiJuGckP0DmceWvM9pjeaIkvmeYsMETqy4y7zUA0GQZjA6CRx3DOCw=@vger.kernel.org X-Gm-Message-State: AOJu0YwOG6r51eAd7Vejg4IoCrjDM+B3TnXrq0HO/6bsUQPxJJ6TLfS2 U7O92FrB4NmQa5JX2T/JUV++tFlsLcafvWRY0isYWHniFYSwH0h/1XJOkKy3hUtnWYw= X-Gm-Gg: ATEYQzzzT9JimQkzeGxOPSeV8VvzXEsZ47/TMbMPGAH+FMiy7CD87OaJIRMydLJdHgG SNQMozBWiavb9R5BCfuHHig3O7X77q6uB6267GXqr4lD3HYc1Jp23jmvGLuO0qlTSwjymtRdNyK pEOzadmWAcKk6uopH4qkcdgLZlMqLg6ffw12aSZRl4Hpk3wT2LZvt6PB5tk0MVJ0NHlaHe5j5G2 dQZWXBskuVwmXYpVeaFw+GnGL1zRO6JMIwGevHypsJyjZP4qVIXdoSflBb1WMR4/rGtxvwODk0B gqGq/2A+aee9bkJJwiAZyCMvefBFjoPNz5as9FlVTr/5LzexLn6ycI3gMEMdr0otESiiNlg3Y+B ubJMjoWnzOpz7b5sEPRf6BS24YjxnzIsVG2m4nJv1iWZJ4afWe/TZzsPQ9Du6/044kTQ9DCzRe0 yXw8ByABCHJlna2E9Qwl9AR9uJ2J3n29LjcKM9zs40PBSrv3KOSIZY9tdZMXC6+hiPgw== X-Received: by 2002:ad4:5de7:0:b0:89a:13fa:c1cf with SMTP id 6a1803df08f44-89ce8f8a73fmr11222326d6.55.1774582416603; Thu, 26 Mar 2026 20:33:36 -0700 (PDT) Received: from plex.localdomain ([71.181.43.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-89cd5a22711sm46519186d6.27.2026.03.26.20.33.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Mar 2026 20:33:36 -0700 (PDT) From: Pasha Tatashin To: rppt@kernel.org, akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, pasha.tatashin@soleen.com, dmatlack@google.com, pratyush@kernel.org, skhawaja@google.com Subject: [PATCH v3 00/10] liveupdate: Fix module unloading and unregister API Date: Fri, 27 Mar 2026 03:33:24 +0000 Message-ID: <20260327033335.696621-1-pasha.tatashin@soleen.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This patch series addresses an issue with how LUO handles module reference counting and unregistration during a module unload (e.g., via rmmod). Currently, modules that register live update file handlers are pinned for the entire duration they are registered. This prevents the modules from being unloaded gracefully, even when no live update session is in progress. Furthermore, if a module is forcefully unloaded, the unregistration functions return an error (e.g. -EBUSY) if a session is active, which is ignored by the kernel's module unload path, leaving dangling pointers in the LUO global lists. To resolve these issues, this series introduces the following changes: 1. Adds a global read-write semaphore (luo_register_rwlock) to protect the registration lists for both file handlers and FLBs. 2. Reduces the scope of module reference counting for file handlers and FLBs. Instead of pinning modules indefinitely upon registration, references are now taken only when they are actively used in a live update session (e.g., during preservation, retrieval, or deserialization). 3. Removes the global luo_session_quiesce() mechanism since module unload behavior now handles active sessions implicitly. 4. Introduces auto-unregistration of FLBs during file handler unregistration to prevent leaving dangling resources. 5. Changes the unregistration functions to return void instead of an error code. 6. Fixes a data race in luo_flb_get_private() by introducing a spinlock for thread-safe lazy initialization. 7. Strengthens security by using %.*s when printing untrusted deserialized compatible strings and session names to prevent out-of-bounds reads. Changelog since v2: - Reintroduced explicit module refcounting for file handlers from v1 to avoid problems during deserialization time and for overall simplicity. - Simplified the locking model by consolidating luo_file_handler_lock, luo_flb_lock, and per-handler flb_lock into a single luo_register_rwlock, based on a suggestion from Samiullah Khawaja. - Replaced scoped_guard() with explicit down/up lock calls in cases where goto is used for error handling, as suggested by Mike Rapoport. - Also add to small hardening fixes: Synchronize lazy initialization of FLB private state and Safely print untrusted strings. [1] https://lore.kernel.org/all/20260303210733.GG972761@nvidia.com [2] https://lore.kernel.org/all/20260318141637.1870220-10-pasha.tatashin@soleen.com Pasha Tatashin (10): liveupdate: Safely print untrusted strings liveupdate: Synchronize lazy initialization of FLB private state liveupdate: Protect file handler list with rwsem liveupdate: Protect FLB lists with luo_register_rwlock liveupdate: Defer FLB module refcounting to active sessions liveupdate: Remove luo_session_quiesce() liveupdate: Auto unregister FLBs on file handler unregistration liveupdate: Remove liveupdate_test_unregister() liveupdate: Make unregister functions return void liveupdate: Defer file handler module refcounting to active sessions include/linux/liveupdate.h | 15 ++- kernel/liveupdate/luo_core.c | 6 + kernel/liveupdate/luo_file.c | 82 +++++--------- kernel/liveupdate/luo_flb.c | 182 ++++++++++++++++--------------- kernel/liveupdate/luo_internal.h | 7 +- kernel/liveupdate/luo_session.c | 46 +------- lib/tests/liveupdate.c | 18 --- 7 files changed, 142 insertions(+), 214 deletions(-) base-commit: 4f1d805a97d6353e4ae468b08ca212641cd26f92 -- 2.43.0