Re: [PATCH] ima: fix kexec measurement buffer overflow after failed loads

[Mimi Zohar <zohar@linux.ibm.com>]

On Sun, 2026-11-08 at 19:04 +0000, Jérémy Jean wrote:
> When kexec_file_load() fails to install a new image, it can leave the
> global IMA scratch buffer larger than the IMA segment of the current
> image. When that image is executed, ima_update_kexec_buffer() copies
> the larger log past the end of its reserved segment. In a test, KASAN
> reports it as:
> 
>   BUG: KASAN: vmalloc-out-of-bounds in ima_update_kexec_buffer+0x265/0x280
>   Write of size 868426 at addr ffffc9000004e000 by task init/1
>   ...
>   Call Trace:
>    ...
>    __asan_memcpy+0x3b/0x60
>    ima_update_kexec_buffer+0x265/0x280
>    ...
>    blocking_notifier_call_chain+0x88/0xb0
>    kernel_restart_prepare+0x18/0x40
>    kernel_kexec+0xe4/0x130
> 
> Limit the dump to the smaller value between the scratch size and the
> installed image segment size. Update the IMA mapping only after
> machine_kexec_post_load() succeeds.
> 
> Fixes: 9f0ec4b16f2b ("ima: kexec: move IMA log copy from kexec load to execute")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>

Thank you for the report. I agree with Mike that the machine_kexec_post_load()
reordering should be a separate patch.

For the overflow, rather than clamping at execute time, how about not changing
ima_kexec_file.size for an image that isn't installed?

  1. Set ima_kexec_file.size only in ima_kexec_post_load(), from
     image->ima_buffer_size, and stop ima_free_kexec_file_buf() from
     resetting it.

  2. Reuse the buffer if size >= segment_size, instead of only if they
     are equal, so the buffer is never smaller than size. The buffer no
     longer tracks size, and with staging the list can shrink.

Please don't remove the "segment size can't change between kexec load and
execute" comments. They are still correct.

Mimi