Re: [PATCH] kho: Don't release incoming bootmem areas when kho_init() fails

[Mike Rapoport <rppt@kernel.org>]

Hi,

On Sat, Nov 07, 2026 at 07:40:50PM -0800, Chris Down wrote:
> kho_populate() adds the incoming bootmem areas without reserving
> them. memblock_free_all() then hands the remainder to the buddy
> allocator.

This paragraph is confusing.
It reads like kho_populate() should have reserved bootmem areas, but it
didn't.
 
> Unfortunately however, if kho_init() fails, err_free_bootmem
> currently frees every area with free_reserved_area(). This can free
> pages still backing early allocations or free buddy pages a second
> time.

Is this an issue you hit in practice or it was reported by a code analysis?

> To fix this, let's only free the areas on a cold boot when
> kho_reserve_bootmem() reserved them.
> 
> Fixes: c609c144b0e8 ("kexec: add KHO parsing support")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Chris Down <chris@chrisdown.name>
> ---
>  kernel/liveupdate/kexec_handover.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
> index 6f1f55fe3181..a566ad6634d8 100644
> --- a/kernel/liveupdate/kexec_handover.c
> +++ b/kernel/liveupdate/kexec_handover.c
> @@ -1899,11 +1899,13 @@ static __init int kho_init(void)
>  	kho_radix_destroy_tree(tree);
>  err_free_bootmem:
>  	kho_out.fdt = NULL;
> -	for (int i = 0; i < kho_bootmem_cnt; i++) {
> -		void *start = __va(kho_bootmem[i].addr);
> -		void *end = start + kho_bootmem[i].size;
> +	if (!fdt) {

I think using !is_kho_boot() makes this clearer.

> +		for (int i = 0; i < kho_bootmem_cnt; i++) {
> +			void *start = __va(kho_bootmem[i].addr);
> +			void *end = start + kho_bootmem[i].size;
>  
> -		free_reserved_area(start, end, -1, "");
> +			free_reserved_area(start, end, -1, "");
> +		}
>  	}
>  	kho_enable = false;
>  	return err;
> 
> base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
> -- 
> 2.54.0
> 

-- 
Sincerely yours,
Mike.