linux-kernel - Re: [PATCH 2/2] ima: Free IMA measurement buffer after kexec syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210121173715.GF259508@sequoia>
Date:   Thu, 21 Jan 2021 11:37:15 -0600
From:   Tyler Hicks <tyhicks@...ux.microsoft.com>
To:     Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>
Cc:     zohar@...ux.ibm.com, bauerman@...ux.ibm.com,
        dmitry.kasatkin@...il.com, ebiederm@...ssion.com,
        gregkh@...uxfoundation.org, sashal@...nel.org,
        linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org,
        linuxppc-dev@...ts.ozlabs.org
Subject: Re: [PATCH 2/2] ima: Free IMA measurement buffer after kexec syscall

On 2021-01-21 09:30:03, Lakshmi Ramasubramanian wrote:
> IMA allocates kernel virtual memory to carry forward the measurement
> list, from the current kernel to the next kernel on kexec system call,
> in ima_add_kexec_buffer() function.  This buffer is not freed before
> completing the kexec system call resulting in memory leak.
> 
> Add ima_buffer field in "struct kimage" to store the virtual address
> of the buffer allocated for the IMA measurement list.
> Free the memory allocated for the IMA measurement list in
> kimage_file_post_load_cleanup() function.
> 
> Signed-off-by: Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>
> Suggested-by: Tyler Hicks <tyhicks@...ux.microsoft.com>
> Fixes: 7b8589cc29e7 ("ima: on soft reboot, save the measurement list")

Reviewed-by: Tyler Hicks <tyhicks@...ux.microsoft.com>

Tyler

> ---
>  include/linux/kexec.h              | 5 +++++
>  kernel/kexec_file.c                | 5 +++++
>  security/integrity/ima/ima_kexec.c | 2 ++
>  3 files changed, 12 insertions(+)
> 
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index 9e93bef52968..5f61389f5f36 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -300,6 +300,11 @@ struct kimage {
>  	/* Information for loading purgatory */
>  	struct purgatory_info purgatory_info;
>  #endif
> +
> +#ifdef CONFIG_IMA_KEXEC
> +	/* Virtual address of IMA measurement buffer for kexec syscall */
> +	void *ima_buffer;
> +#endif
>  };
>  
>  /* kexec interface functions */
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index b02086d70492..5c3447cf7ad5 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -166,6 +166,11 @@ void kimage_file_post_load_cleanup(struct kimage *image)
>  	vfree(pi->sechdrs);
>  	pi->sechdrs = NULL;
>  
> +#ifdef CONFIG_IMA_KEXEC
> +	vfree(image->ima_buffer);
> +	image->ima_buffer = NULL;
> +#endif /* CONFIG_IMA_KEXEC */
> +
>  	/* See if architecture has anything to cleanup post load */
>  	arch_kimage_file_post_load_cleanup(image);
>  
> diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
> index 212145008a01..8eadd0674629 100644
> --- a/security/integrity/ima/ima_kexec.c
> +++ b/security/integrity/ima/ima_kexec.c
> @@ -130,6 +130,8 @@ void ima_add_kexec_buffer(struct kimage *image)
>  		return;
>  	}
>  
> +	image->ima_buffer = kexec_buffer;
> +
>  	pr_debug("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
>  		 kbuf.mem);
>  }
> -- 
> 2.30.0
>