Hi Vaibhav, On 5/18/2022 1:05 PM, Vaibhav Jain wrote:
Presently ima_get_kexec_buffer() doesn't check if the previous kernel's ima-kexec-buffer lies outside the addressable memory range. This can result in a kernel panic if the new kernel is booted with 'mem=X' arg and the ima-kexec-buffer was allocated beyond that range by the previous kernel.
Thanks for providing this patch.
Fix this issue by checking returned address/size of previous kernel's ima-kexec-buffer against memblock's memory bounds. Fixes: fee3ff99bc67("powerpc: Move arch independent ima kexec functions to drivers/of/kexec.c") Cc: Frank Rowand <frowand.list@xxxxxxxxx> Cc: Prakhar Srivastava <prsriva@xxxxxxxxxxxxxxxxxxx> Cc: Lakshmi Ramasubramanian <nramas@xxxxxxxxxxxxxxxxxxx> Cc: Thiago Jung Bauermann <bauerman@xxxxxxxxxxxxx> Cc: Rob Herring <robh@xxxxxxxxxx> Signed-off-by: Vaibhav Jain <vaibhav@xxxxxxxxxxxxx> --- drivers/of/kexec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c index b9bd1cff1793..c73007eda52d 100644 --- a/drivers/of/kexec.c +++ b/drivers/of/kexec.c @@ -140,6 +140,13 @@ int ima_get_kexec_buffer(void **addr, size_t *size) if (ret) return ret;+ /* if the ima-kexec-buffer goes beyond the addressable memory */+ if (!memblock_is_region_memory(tmp_addr, tmp_size)) { + pr_warn("IMA buffer at 0x%lx, size = 0x%zx beyond memory\n", + tmp_addr, tmp_size); + return -EINVAL; + } +
Reviewed-by: Lakshmi Ramasubramanian <nramas@xxxxxxxxxxxxxxxxxxx>
*addr = __va(tmp_addr); *size = tmp_size;
