Re: [PATCH] ima: fix kexec measurement buffer overflow after failed loads

[sashiko-bot@kernel.org]

> When kexec_file_load() fails to install a new image, it can leave the
> global IMA scratch buffer larger than the IMA segment of the current
> image. When that image is executed, ima_update_kexec_buffer() copies
> the larger log past the end of its reserved segment. In a test, KASAN
> reports it as:
> 
>   BUG: KASAN: vmalloc-out-of-bounds in ima_update_kexec_buffer+0x265/0x280
>   Write of size 868426 at addr ffffc9000004e000 by task init/1
>   ...
>   Call Trace:
>    ...
>    __asan_memcpy+0x3b/0x60
>    ima_update_kexec_buffer+0x265/0x280
>    ...
>    blocking_notifier_call_chain+0x88/0xb0
>    kernel_restart_prepare+0x18/0x40
>    kernel_kexec+0xe4/0x130
> 
> Limit the dump to the smaller value between the scratch size and the
> installed image segment size. Update the IMA mapping only after
> machine_kexec_post_load() succeeds.
> 
> Fixes: 9f0ec4b16f2b ("ima: kexec: move IMA log copy from kexec load to execute")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108190404.1397829-2-Jeremy.Jean@oss.cyber.gouv.fr?part=1