[PATCH] kho: Prevent reuse of preserved pages after a reservation failure

[Chris Down <chris@chrisdown.name>]

kho_preserved_memory_reserve() reserves each range of preserved memory
in memblock and marks it noinit, but ignores both return values. Either
can fail when memblock has to grow its reserved array and can't find
room, which at this point in boot it may only take from KHO bootmem.
The boot then goes on as if the range were reserved, and two things
can follow:

- If the reservation failed, memblock_free_all() hands the range to the
  page allocator with the previous kernel's data still in it, while its
  KHO user still expects to restore it. A memfd preserved through LUO
  can then get back pages that belong to someone else. Oh dear!
- If only the noinit marking failed, the struct pages can be
  initialised later, wiping the KHO magic, so restoring the range fails.

Dropping the handover at this point isn't safe either. reserve_mem=
revives its regions from the handover before mm_core_init(), and
relies on this walk to reserve them.

Carrying on could hand out private data, so let's panic if either call
fails.

Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation")
Signed-off-by: Chris Down <chris@chrisdown.name>
---
 kernel/liveupdate/kexec_handover.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
index eeec298aa9d6..0faa21ebb0cf 100644
--- a/kernel/liveupdate/kexec_handover.c
+++ b/kernel/liveupdate/kexec_handover.c
@@ -629,9 +629,14 @@ static int __init kho_preserved_memory_reserve(unsigned long key, void *data)
 	sz = 1UL << (order + PAGE_SHIFT);
 	page = kho_get_preserved_page(phys, order);
 
-	/* Reserve the memory preserved in KHO in memblock */
-	memblock_reserve(phys, sz);
-	memblock_reserved_mark_noinit(phys, sz);
+	/*
+	 * Reserve the memory preserved in KHO in memblock. It's too late to
+	 * drop the handover if that fails: reserve_mem may already have revived
+	 * regions from it.
+	 */
+	if (memblock_reserve(phys, sz) || memblock_reserved_mark_noinit(phys, sz))
+		panic("KHO: failed to reserve preserved memory %pa+%#llx\n",
+		      &phys, sz);
 	info.magic = KHO_PAGE_MAGIC;
 	info.order = order;
 	page->private = info.page_private;

base-commit: a0dc8eddbfdb6dd9c5c2b70eb66ab49cb1978425
-- 
2.54.0