On Mon, Jan 26, 2026 at 08:07:23AM -0800, Breno Leitao wrote: > kho_add_subtree() assumes the fdt argument is always an FDT and calls > fdt_totalsize() on it in the debugfs code path. This assumption will > break if a caller passes arbitrary data instead of an FDT. > > When CONFIG_KEXEC_HANDOVER_DEBUGFS is enabled, kho_debugfs_fdt_add() > calls __kho_debugfs_fdt_add(), which executes: > > f->wrapper.size = fdt_totalsize(fdt); > > Fix this by adding an explicit size parameter to kho_add_subtree() so > callers specify the blob size. This allows subtrees to contain > arbitrary data formats, not just FDTs. Update all callers: > > - memblock.c: use fdt_totalsize(fdt) > - luo_core.c: use fdt_totalsize(fdt_out) > - test_kho.c: use fdt_totalsize() > - kexec_handover.c (root fdt): use fdt_totalsize(kho_out.fdt) > > Also update kho_in_debugfs_init() to compute sizes using fdt_totalsize() > for the root and sub-FDTs it processes, since these are known to be > actual FDT blobs. > > Suggested-by: Pratyush Yadav <[email protected]> > Signed-off-by: Breno Leitao <[email protected]>
Reviewed-by: Mike Rapoport (Microsoft) <[email protected]> > --- > include/linux/kexec_handover.h | 4 ++-- > kernel/liveupdate/kexec_handover.c | 8 +++++--- > kernel/liveupdate/kexec_handover_debugfs.c | 15 +++++++++------ > kernel/liveupdate/kexec_handover_internal.h | 5 +++-- > kernel/liveupdate/luo_core.c | 3 ++- > lib/test_kho.c | 3 ++- > mm/memblock.c | 2 +- > 7 files changed, 24 insertions(+), 16 deletions(-) > > diff --git a/include/linux/kexec_handover.h b/include/linux/kexec_handover.h > index ac4129d1d7416..abb1d324f42d0 100644 > --- a/include/linux/kexec_handover.h > +++ b/include/linux/kexec_handover.h > @@ -32,7 +32,7 @@ void kho_restore_free(void *mem); > struct folio *kho_restore_folio(phys_addr_t phys); > struct page *kho_restore_pages(phys_addr_t phys, unsigned long nr_pages); > void *kho_restore_vmalloc(const struct kho_vmalloc *preservation); > -int kho_add_subtree(const char *name, void *fdt); > +int kho_add_subtree(const char *name, void *fdt, size_t size); I'd rename 'void *fdt' to 'void *blob' to make it clearer that subtree isn't necessary an FDT. And s/fdt/blob/ in debugfs function names. All this could be a separate cleanup. -- Sincerely yours, Mike.
