diff options
author | Pratyush Yadav <pratyush@kernel.org> | 2025-09-17 14:56:54 +0200 |
---|---|---|
committer | Andrew Morton <akpm@linux-foundation.org> | 2025-09-23 14:14:17 -0700 |
commit | 89a3ecca49ee889cc1ab4def6caa0452df196efb (patch) | |
tree | e046ee6fb61d80996c33c7c8c7ce58ce054f17f6 /drivers/cdx/controller/cdx_controller.c | |
parent | 20571b187051e5b78b48b99c9bdd425c94b29e18 (diff) |
kho: make sure page being restored is actually from KHO
When restoring a page, no sanity checks are done to make sure the page
actually came from a kexec handover. The caller is trusted to pass in the
right address. If the caller has a bug and passes in a wrong address, an
in-use page might be "restored" and returned, causing all sorts of memory
corruption.
Harden the page restore logic by stashing in a magic number in
page->private along with the order. If the magic number does not match,
the page won't be touched. page->private is an unsigned long. The union
kho_page_info splits it into two parts, with one holding the order and the
other holding the magic number.
Link: https://lkml.kernel.org/r/20250917125725.665-2-pratyush@kernel.org
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
Cc: Alexander Graf <graf@amazon.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Changyuan Lyu <changyuanl@google.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Jason Gunthorpe <jgg@nvidia.com>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'drivers/cdx/controller/cdx_controller.c')
0 files changed, 0 insertions, 0 deletions