[PATCH] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)

[PATCH] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)

[Roberto Sassu]

From: Roberto Sassu <roberto.sassu@huawei.com>

The ima_get/free_kexec_buffer() device tree implementation relies on the
arch code calling of_kexec_alloc_and_setup_fdt() to pass the information
about where the IMA kexec buffer is located. Only the arm64, powerpc and
riscv architectures support that. LoongArch implicitly assumes that the
device tree implementation is used, but it does not call that function.

The ima_get/free_kexec_buffer() x86 implementation instead still relies on
the setup data to pass the kexec buffer information, and is built only if
CONFIG_OF_FLATTREE is not defined.

However, if CONFIG_OF_FLATTREE is selected in x86, x86 attempts to use the
device tree implementations of ima_get/free_kexec_buffer(), which are never
going to succeed because of_kexec_alloc_and_setup_fdt() is not called for
that architecture.

Instead, define CONFIG_HAVE_IMA_KEXEC_OF (automatically selects
HAVE_IMA_KEXEC), select it for the architectures that should use the
ima_get/free_kexec_buffer() device tree implementation, and enable these
functions if the new config option is enabled. Set it also on LoongArch, to
preserve the current behavior and avoid a link failure. LoongArch does not
pass the buffer location to the next kernel yet; this will be addressed
separately.

Finally, don't select it for x86, and use x86's own setup_data-based
implementation regardless of CONFIG_OF_FLATTREE.

Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 arch/arm64/Kconfig      | 2 +-
 arch/loongarch/Kconfig  | 2 +-
 arch/powerpc/Kconfig    | 2 +-
 arch/riscv/Kconfig      | 2 +-
 arch/x86/kernel/setup.c | 2 +-
 drivers/of/kexec.c      | 4 ++--
 kernel/Kconfig.kexec    | 4 ++++
 7 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index b5a51b0ef944..4b7e248b6c91 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1697,7 +1697,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
 config ARCH_SELECTS_KEXEC_FILE
 	def_bool y
 	depends on KEXEC_FILE
-	select HAVE_IMA_KEXEC if IMA
+	select HAVE_IMA_KEXEC_OF if IMA
 
 config ARCH_SUPPORTS_KEXEC_SIG
 	def_bool y
diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
index 2067d1f2ad7a..b5420d482da4 100644
--- a/arch/loongarch/Kconfig
+++ b/arch/loongarch/Kconfig
@@ -690,7 +690,7 @@ config ARCH_SELECTS_KEXEC_FILE
 	depends on KEXEC_FILE
 	select KEXEC_ELF
 	select RELOCATABLE
-	select HAVE_IMA_KEXEC if IMA
+	select HAVE_IMA_KEXEC_OF if IMA
 
 config ARCH_SUPPORTS_CRASH_DUMP
 	def_bool 64BIT
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 2580e27e4328..096c6061893b 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -643,7 +643,7 @@ config ARCH_SELECTS_KEXEC_FILE
 	def_bool y
 	depends on KEXEC_FILE
 	select KEXEC_ELF
-	select HAVE_IMA_KEXEC if IMA
+	select HAVE_IMA_KEXEC_OF if IMA
 
 config PPC64_BIG_ENDIAN_ELF_ABI_V2
 	# Option is available to BFD, but LLD does not support ELFv1 so this is
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index f8e26c4bed2b..161bf8a65beb 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -1118,7 +1118,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
 config ARCH_SELECTS_KEXEC_FILE
 	def_bool y
 	depends on KEXEC_FILE
-	select HAVE_IMA_KEXEC if IMA
+	select HAVE_IMA_KEXEC_OF if IMA
 	select KEXEC_ELF
 
 config ARCH_SUPPORTS_KEXEC_PURGATORY
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index cda6adb9f69c..bc17e353c099 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -421,7 +421,7 @@ static void __init add_early_ima_buffer(u64 phys_addr)
 #endif
 }
 
-#if defined(CONFIG_HAVE_IMA_KEXEC) && !defined(CONFIG_OF_FLATTREE)
+#ifdef CONFIG_HAVE_IMA_KEXEC
 int __init ima_free_kexec_buffer(void)
 {
 	if (!ima_kexec_buffer_size)
diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c
index 029903b986cb..724f29fef0c0 100644
--- a/drivers/of/kexec.c
+++ b/drivers/of/kexec.c
@@ -116,7 +116,7 @@ static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr,
 	return 0;
 }
 
-#ifdef CONFIG_HAVE_IMA_KEXEC
+#ifdef CONFIG_HAVE_IMA_KEXEC_OF
 /**
  * ima_get_kexec_buffer - get IMA buffer from the previous kernel
  * @addr:	On successful return, set to point to the buffer contents.
@@ -196,7 +196,7 @@ static void remove_ima_buffer(void *fdt, int chosen_node)
 	size_t size;
 	const void *prop;
 
-	if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC))
+	if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC_OF))
 		return;
 
 	prop = fdt_getprop(fdt, chosen_node, "linux,ima-kexec-buffer", &len);
diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
index 15632358bcf7..c6ed60f04ea4 100644
--- a/kernel/Kconfig.kexec
+++ b/kernel/Kconfig.kexec
@@ -17,6 +17,10 @@ config KEXEC_ELF
 config HAVE_IMA_KEXEC
 	bool
 
+config HAVE_IMA_KEXEC_OF
+	bool
+	select HAVE_IMA_KEXEC
+
 config KEXEC
 	bool "Enable kexec system call"
 	depends on ARCH_SUPPORTS_KEXEC
-- 
2.43.0

Re: [PATCH] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ima: off-by-one in ima_validate_range bypasses memory boundary check
--

commit 7ddca2cd41824acc187deeda05f385f27ac90508
Author: Roberto Sassu <roberto.sassu@huawei.com>

kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)

This commit introduces CONFIG_HAVE_IMA_KEXEC_OF and selects it for
architectures using the device tree implementation for IMA kexec buffers.
It also modifies x86 to use its own setup_data-based implementation
regardless of CONFIG_OF_FLATTREE.

> diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
> index cda6adb9f69c4..bc17e353c0992 100644
> --- a/arch/x86/kernel/setup.c
> +++ b/arch/x86/kernel/setup.c
[ ... ]
> @@ -421,7 +421,7 @@ static void __init add_early_ima_buffer(u64 phys_addr)
>  #endif
>  }
>  
> -#if defined(CONFIG_HAVE_IMA_KEXEC) && !defined(CONFIG_OF_FLATTREE)
> +#ifdef CONFIG_HAVE_IMA_KEXEC
>  int __init ima_free_kexec_buffer(void)
>  {

[Severity: High]
Does enabling this on x86 expose an off-by-one regression in how IMA validates
the memory range?

In security/integrity/ima/ima_kexec.c:ima_validate_range(), the end_pfn is
calculated inclusively:

    end_phys = phys + size - 1;
    end_pfn = PHYS_PFN(end_phys);

However, on x86, this inclusive end_pfn is passed to pfn_range_is_mapped():

    if (!pfn_range_is_mapped(start_pfn, end_pfn))

Looking at arch/x86/mm/init.c:pfn_range_is_mapped(), it expects an exclusive
end_pfn boundary, checking if the region is within pfn_mapped[i]:

    if ((start_pfn >= pfn_mapped[i].start) &&
        (end_pfn <= pfn_mapped[i].end))

Because ima_validate_range() passes an inclusive PFN, the validated range is
effectively one page smaller than the actual buffer. If the actual buffer
extends exactly one page beyond the valid mapped memory, could
pfn_range_is_mapped() incorrectly return true?

Would the subsequent direct map access via __va(ima_kexec_buffer_phys) up
to size hit the unmapped page, resulting in an out-of-bounds access
during boot?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014150005.138309-1-roberto.sassu@huaweicloud.com?part=1