Messages in this thread | | | Date | Wed, 18 May 2022 13:30:49 -0700 | Subject | Re: [PATCH] powerpc: check previous kernel's ima-kexec-buffer against memory bounds | From | Lakshmi Ramasubramanian <> |
| |
Hi Vaibhav,
On 5/18/2022 1:05 PM, Vaibhav Jain wrote: > Presently ima_get_kexec_buffer() doesn't check if the previous kernel's > ima-kexec-buffer lies outside the addressable memory range. This can result > in a kernel panic if the new kernel is booted with 'mem=X' arg and the > ima-kexec-buffer was allocated beyond that range by the previous kernel.
Thanks for providing this patch.
> Fix this issue by checking returned address/size of previous kernel's > ima-kexec-buffer against memblock's memory bounds. > > Fixes: fee3ff99bc67("powerpc: Move arch independent ima kexec functions to > drivers/of/kexec.c") > > Cc: Frank Rowand <frowand.list@gmail.com> > Cc: Prakhar Srivastava <prsriva@linux.microsoft.com> > Cc: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> > Cc: Thiago Jung Bauermann <bauerman@linux.ibm.com> > Cc: Rob Herring <robh@kernel.org> > Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com> > --- > drivers/of/kexec.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c > index b9bd1cff1793..c73007eda52d 100644 > --- a/drivers/of/kexec.c > +++ b/drivers/of/kexec.c > @@ -140,6 +140,13 @@ int ima_get_kexec_buffer(void **addr, size_t *size) > if (ret) > return ret; > > + /* if the ima-kexec-buffer goes beyond the addressable memory */ > + if (!memblock_is_region_memory(tmp_addr, tmp_size)) { > + pr_warn("IMA buffer at 0x%lx, size = 0x%zx beyond memory\n", > + tmp_addr, tmp_size); > + return -EINVAL; > + } > + Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
> *addr = __va(tmp_addr); > *size = tmp_size; >
| |