[PATCH] kho: Don't release incoming bootmem areas when kho_init() fails

[PATCH] kho: Don't release incoming bootmem areas when kho_init() fails

[Chris Down]

kho_populate() adds the incoming bootmem areas without reserving
them. memblock_free_all() then hands the remainder to the buddy
allocator.

Unfortunately however, if kho_init() fails, err_free_bootmem
currently frees every area with free_reserved_area(). This can free
pages still backing early allocations or free buddy pages a second
time.

To fix this, let's only free the areas on a cold boot when
kho_reserve_bootmem() reserved them.

Fixes: c609c144b0e8 ("kexec: add KHO parsing support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Chris Down <chris@chrisdown.name>
---
 kernel/liveupdate/kexec_handover.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
index 6f1f55fe3181..a566ad6634d8 100644
--- a/kernel/liveupdate/kexec_handover.c
+++ b/kernel/liveupdate/kexec_handover.c
@@ -1899,11 +1899,13 @@ static __init int kho_init(void)
 	kho_radix_destroy_tree(tree);
 err_free_bootmem:
 	kho_out.fdt = NULL;
-	for (int i = 0; i < kho_bootmem_cnt; i++) {
-		void *start = __va(kho_bootmem[i].addr);
-		void *end = start + kho_bootmem[i].size;
+	if (!fdt) {
+		for (int i = 0; i < kho_bootmem_cnt; i++) {
+			void *start = __va(kho_bootmem[i].addr);
+			void *end = start + kho_bootmem[i].size;
 
-		free_reserved_area(start, end, -1, "");
+			free_reserved_area(start, end, -1, "");
+		}
 	}
 	kho_enable = false;
 	return err;

base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
-- 
2.54.0

Re: [PATCH] kho: Don't release incoming bootmem areas when kho_init() fails

[Pasha Tatashin]

On Sat, 07 Nov 2026 19:40:50 -0800, Chris Down <chris@chrisdown.name> wrote:
> kho_populate() adds the incoming bootmem areas without reserving
> them. memblock_free_all() then hands the remainder to the buddy
> allocator.
> 
> Unfortunately however, if kho_init() fails, err_free_bootmem
> currently frees every area with free_reserved_area(). This can free
> pages still backing early allocations or free buddy pages a second
> time.
> 
> [...]

Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>

-- 
Pasha

Re: [PATCH] kho: Don't release incoming bootmem areas when kho_init() fails

[Mike Rapoport]

Hi,

On Sat, Nov 07, 2026 at 07:40:50PM -0800, Chris Down wrote:
> kho_populate() adds the incoming bootmem areas without reserving
> them. memblock_free_all() then hands the remainder to the buddy
> allocator.

This paragraph is confusing.
It reads like kho_populate() should have reserved bootmem areas, but it
didn't.
 
> Unfortunately however, if kho_init() fails, err_free_bootmem
> currently frees every area with free_reserved_area(). This can free
> pages still backing early allocations or free buddy pages a second
> time.

Is this an issue you hit in practice or it was reported by a code analysis?

> To fix this, let's only free the areas on a cold boot when
> kho_reserve_bootmem() reserved them.
> 
> Fixes: c609c144b0e8 ("kexec: add KHO parsing support")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Chris Down <chris@chrisdown.name>
> ---
>  kernel/liveupdate/kexec_handover.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
> index 6f1f55fe3181..a566ad6634d8 100644
> --- a/kernel/liveupdate/kexec_handover.c
> +++ b/kernel/liveupdate/kexec_handover.c
> @@ -1899,11 +1899,13 @@ static __init int kho_init(void)
>  	kho_radix_destroy_tree(tree);
>  err_free_bootmem:
>  	kho_out.fdt = NULL;
> -	for (int i = 0; i < kho_bootmem_cnt; i++) {
> -		void *start = __va(kho_bootmem[i].addr);
> -		void *end = start + kho_bootmem[i].size;
> +	if (!fdt) {

I think using !is_kho_boot() makes this clearer.

> +		for (int i = 0; i < kho_bootmem_cnt; i++) {
> +			void *start = __va(kho_bootmem[i].addr);
> +			void *end = start + kho_bootmem[i].size;
>  
> -		free_reserved_area(start, end, -1, "");
> +			free_reserved_area(start, end, -1, "");
> +		}
>  	}
>  	kho_enable = false;
>  	return err;
> 
> base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
> -- 
> 2.54.0
> 

-- 
Sincerely yours,
Mike.