[PATCH] kho: fix size calculation in kho_preserved_memory_reserve()

[Pratyush Yadav]

From: "Pratyush Yadav (Google)" <pratyush@xxxxxxxxxx>

kho_preserved_memory_reserve() calculates the size of a preservation by
doing 1 << (order + PAGE_SHIFT). Since the '1' is a 32-bit integer, it
can only be shifted by 31. That is, it will only work for preservations
up to 2 GiB. Larger preservations will trigger undefined behaviour.

While preservations larger than 2 GiB can't be obtained via folios
currently, they can be obtained via kho_preserve_pages().

For example, memblock reserve_mem uses kho_preserve_pages().
Reservations larger than 2 GiB are valid and will trigger this bug if
properly aligned.

Fix it by using 1UL for shifting.

Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Pratyush Yadav (Google) <pratyush@xxxxxxxxxx>

---
Stable backport note: This patch fixes kho_preserved_memory_reserve(),
which was added by 3f2ad90060f6 ("kho: adopt radix tree for preserved
memory tracking") in v7.1. The bug in older kernels was in
deserialize_bitmap(), which was added by fc33e4b44b27 ("kexec: enable
KHO support for memory preservation") in v6.16.
---
 kernel/liveupdate/kexec_handover.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
index 175c08a6e41e..6fad9152387a 100644
--- a/kernel/liveupdate/kexec_handover.c
+++ b/kernel/liveupdate/kexec_handover.c
@@ -501,7 +501,7 @@ static int __init kho_preserved_memory_reserve(phys_addr_t phys,
 	struct page *page;
 	u64 sz;
 
-	sz = 1 << (order + PAGE_SHIFT);
+	sz = 1UL << (order + PAGE_SHIFT);
 	page = kho_get_preserved_page(phys, order);
 
 	/* Reserve the memory preserved in KHO in memblock */

base-commit: 5c4a03afcb21783987ffc64562b76ddd5a21b12b
-- 
2.55.0.229.g6434b31f56-goog