Hi Vaibhav,
On 5/18/2022 1:05 PM, Vaibhav Jain wrote:
Presently ima_get_kexec_buffer() doesn't check if the previous kernel's
ima-kexec-buffer lies outside the addressable memory range. This can result
in a kernel panic if the new kernel is booted with 'mem=X' arg and the
ima-kexec-buffer was allocated beyond that range by the previous kernel.
Thanks for providing this patch.
Fix this issue by checking returned address/size of previous kernel's
ima-kexec-buffer against memblock's memory bounds.
Fixes: fee3ff99bc67("powerpc: Move arch independent ima kexec functions to
drivers/of/kexec.c")
Cc: Frank Rowand <frowand.l...@gmail.com>
Cc: Prakhar Srivastava <prsr...@linux.microsoft.com>
Cc: Lakshmi Ramasubramanian <nra...@linux.microsoft.com>
Cc: Thiago Jung Bauermann <bauer...@linux.ibm.com>
Cc: Rob Herring <r...@kernel.org>
Signed-off-by: Vaibhav Jain <vaib...@linux.ibm.com>
---
drivers/of/kexec.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c
index b9bd1cff1793..c73007eda52d 100644
--- a/drivers/of/kexec.c
+++ b/drivers/of/kexec.c
@@ -140,6 +140,13 @@ int ima_get_kexec_buffer(void **addr, size_t *size)
if (ret)
return ret;
+ /* if the ima-kexec-buffer goes beyond the addressable memory */
+ if (!memblock_is_region_memory(tmp_addr, tmp_size)) {
+ pr_warn("IMA buffer at 0x%lx, size = 0x%zx beyond memory\n",
+ tmp_addr, tmp_size);
+ return -EINVAL;
+ }
+
Reviewed-by: Lakshmi Ramasubramanian <nra...@linux.microsoft.com>
*addr = __va(tmp_addr);
*size = tmp_size;
