linux-kernel - Re: [PATCH v3 1/3] ima: verify the previous kernel's IMA buffer lies in addressable RAM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8d780b6eff19fd61096c07768cf730b985d29177.camel@linux.ibm.com>
Date: Fri, 02 Jan 2026 15:30:20 -0500
From: Mimi Zohar <zohar@...ux.ibm.com>
To: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>,
        akpm@...ux-foundation.org
Cc: ardb@...nel.org, bp@...en8.de, dave.hansen@...ux.intel.com,
        graf@...zon.com, guoweikang.kernel@...il.com, henry.willard@...cle.com,
        hpa@...or.com, jbohac@...e.cz, joel.granados@...nel.org,
        linux-kernel@...r.kernel.org, mingo@...hat.com, noodles@...com,
        paul.x.webb@...cle.com, rppt@...nel.org, sohil.mehta@...el.com,
        sourabhjain@...ux.ibm.com, stable@...r.kernel.org, tglx@...utronix.de,
        x86@...nel.org, yifei.l.liu@...cle.com
Subject: Re: [PATCH v3 1/3] ima: verify the previous kernel's IMA buffer
 lies in addressable RAM

On Tue, 2025-12-30 at 22:16 -0800, Harshit Mogalapalli wrote:
> When the second-stage kernel is booted with a limiting command line
> (e.g. "mem=<size>"), the IMA measurement buffer handed over from the
> previous kernel may fall outside the addressable RAM of the new kernel.
> Accessing such a buffer can fault during early restore.
> 
> Introduce a small generic helper, ima_validate_range(), which verifies
> that a physical [start, end] range for the previous-kernel IMA buffer
> lies within addressable memory:
> 	- On x86, use pfn_range_is_mapped().
> 	- On OF based architectures, use page_is_ram().
> 
> Cc: stable@...r.kernel.org
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>

Thanks!

Reviewed-by: Mimi Zohar <zohar@...ux.ibm.com>

> ---
> v2->v3: Update subject to exactly describe the patch [ Suggested by Mimi
> Zohar]
> ---
>  include/linux/ima.h                |  1 +
>  security/integrity/ima/ima_kexec.c | 35 ++++++++++++++++++++++++++++++
>  2 files changed, 36 insertions(+)
> 
> diff --git a/include/linux/ima.h b/include/linux/ima.h
> index 8e29cb4e6a01..abf8923f8fc5 100644
> --- a/include/linux/ima.h
> +++ b/include/linux/ima.h
> @@ -69,6 +69,7 @@ static inline int ima_measure_critical_data(const char *event_label,
>  #ifdef CONFIG_HAVE_IMA_KEXEC
>  int __init ima_free_kexec_buffer(void);
>  int __init ima_get_kexec_buffer(void **addr, size_t *size);
> +int ima_validate_range(phys_addr_t phys, size_t size);
>  #endif
>  
>  #ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
> diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
> index 7362f68f2d8b..8b24e3312ea0 100644
> --- a/security/integrity/ima/ima_kexec.c
> +++ b/security/integrity/ima/ima_kexec.c
> @@ -12,6 +12,8 @@
>  #include <linux/kexec.h>
>  #include <linux/of.h>
>  #include <linux/ima.h>
> +#include <linux/mm.h>
> +#include <linux/overflow.h>
>  #include <linux/reboot.h>
>  #include <asm/page.h>
>  #include "ima.h"
> @@ -296,3 +298,36 @@ void __init ima_load_kexec_buffer(void)
>  		pr_debug("Error restoring the measurement list: %d\n", rc);
>  	}
>  }
> +
> +/*
> + * ima_validate_range - verify a physical buffer lies in addressable RAM
> + * @phys: physical start address of the buffer from previous kernel
> + * @size: size of the buffer
> + *
> + * On success return 0. On failure returns -EINVAL so callers can skip
> + * restoring.
> + */
> +int ima_validate_range(phys_addr_t phys, size_t size)
> +{
> +	unsigned long start_pfn, end_pfn;
> +	phys_addr_t end_phys;
> +
> +	if (check_add_overflow(phys, (phys_addr_t)size - 1, &end_phys))
> +		return -EINVAL;
> +
> +	start_pfn = PHYS_PFN(phys);
> +	end_pfn = PHYS_PFN(end_phys);
> +
> +#ifdef CONFIG_X86
> +	if (!pfn_range_is_mapped(start_pfn, end_pfn))
> +#else
> +	if (!page_is_ram(start_pfn) || !page_is_ram(end_pfn))
> +#endif
> +	{
> +		pr_warn("IMA: previous kernel measurement buffer %pa (size 0x%zx) lies outside available memory\n",
> +			&phys, size);
> +		return -EINVAL;
> +	}
> +
> +	return 0;
> +}