Re: [PATCH v2 2/3] ima: keep kexec dump state tied to installed image

[Mimi Zohar <zohar@linux.ibm.com>]

On Thu, 2026-11-12 at 12:52 +0000, Jérémy Jean wrote:
[...]

> diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
> index 0d845693a1f7..3aa8b1096f81 100644
> --- a/security/integrity/ima/ima_kexec.c
> +++ b/security/integrity/ima/ima_kexec.c
> @@ -35,7 +35,8 @@ static void ima_free_kexec_file_buf(struct seq_file *sf)
>  	sf->count = 0;
>  }
>  
> -void ima_measure_kexec_event(const char *event_name)
> +static void ima_measure_kexec_event_size(const char *event_name,
> +					 size_t segment_size)
>  {
>  	char ima_kexec_event[IMA_KEXEC_EVENT_LEN];
>  	size_t buf_size = 0;
> @@ -48,35 +49,26 @@ void ima_measure_kexec_event(const char *event_name)
>  	n = scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
>  		      "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;"
>  		      "ima_runtime_measurements_count=%ld;",
> -		      kexec_segment_size, buf_size, len);
> +		      segment_size, buf_size, len);
>  
>  	ima_measure_critical_data("ima_kexec", event_name, ima_kexec_event, n, false, NULL, 0);
>  }
>  
> -static int ima_alloc_kexec_file_buf(size_t segment_size)
> +void ima_measure_kexec_event(const char *event_name)
>  {
> -	/*
> -	 * kexec 'load' may be called multiple times.
> -	 * Free and realloc the buffer only if the segment_size is
> -	 * changed from the previous kexec 'load' call.
> -	 */
> -	if (ima_kexec_file.buf && ima_kexec_file.size == segment_size)
> -		goto out;
> +	ima_measure_kexec_event_size(event_name, kexec_segment_size);
> +}
>  
> -	ima_free_kexec_file_buf(&ima_kexec_file);
> +static int ima_alloc_kexec_file_buf(struct kimage *image, size_t segment_size)
> +{
> +	if (ima_kexec_file.buf && ima_kexec_file.size == segment_size)
> +		return 0;

Please don't drop the comment. The crux of the problem is that a kexec
load may fail, so the installed image's state shouldn't change until
the new image is installed.

To keep this patch as small as possible, could the event-size change be
a separate patch, applied after this one? That would make the overflow
fix easier to review and backport.

Suggested comment:

 * kexec 'load' may be called multiple times, and a load may fail.
 * ima_kexec_file.size is the segment size of the installed image and
 * is only set in ima_kexec_post_load(). Reuse the installed buffer if
 * the segment_size is unchanged, otherwise stage a new one on the image.

Mimi

>  
>  	/* segment size can't change between kexec load and execute */
> -	ima_kexec_file.buf = vmalloc(segment_size);
> -	if (!ima_kexec_file.buf)
> +	image->ima_buffer = vmalloc(segment_size);
> +	if (!image->ima_buffer)
>  		return -ENOMEM;
>  
> -	ima_kexec_file.size = segment_size;
> -
> -out:
> -	ima_kexec_file.read_pos = 0;
> -	ima_kexec_file.count = sizeof(struct ima_kexec_hdr);	/* reserved space */
> -	ima_measure_kexec_event("kexec_load");
> -
>  	return 0;
>  }
>