Re: [PATCH v3 1/3] ima: verify the previous kernel's IMA buffer lies in addressable RAM

[Mimi Zohar <zohar@linux.ibm.com>]

On Tue, 2025-12-30 at 22:16 -0800, Harshit Mogalapalli wrote:
> When the second-stage kernel is booted with a limiting command line
> (e.g. "mem=<size>"), the IMA measurement buffer handed over from the
> previous kernel may fall outside the addressable RAM of the new kernel.
> Accessing such a buffer can fault during early restore.
> 
> Introduce a small generic helper, ima_validate_range(), which verifies
> that a physical [start, end] range for the previous-kernel IMA buffer
> lies within addressable memory:
> 	- On x86, use pfn_range_is_mapped().
> 	- On OF based architectures, use page_is_ram().
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>

Thanks!

Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>

> ---
> v2->v3: Update subject to exactly describe the patch [ Suggested by Mimi
> Zohar]
> ---
>  include/linux/ima.h                |  1 +
>  security/integrity/ima/ima_kexec.c | 35 ++++++++++++++++++++++++++++++
>  2 files changed, 36 insertions(+)
> 
> diff --git a/include/linux/ima.h b/include/linux/ima.h
> index 8e29cb4e6a01..abf8923f8fc5 100644
> --- a/include/linux/ima.h
> +++ b/include/linux/ima.h
> @@ -69,6 +69,7 @@ static inline int ima_measure_critical_data(const char *event_label,
>  #ifdef CONFIG_HAVE_IMA_KEXEC
>  int __init ima_free_kexec_buffer(void);
>  int __init ima_get_kexec_buffer(void **addr, size_t *size);
> +int ima_validate_range(phys_addr_t phys, size_t size);
>  #endif
>  
>  #ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
> diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
> index 7362f68f2d8b..8b24e3312ea0 100644
> --- a/security/integrity/ima/ima_kexec.c
> +++ b/security/integrity/ima/ima_kexec.c
> @@ -12,6 +12,8 @@
>  #include <linux/kexec.h>
>  #include <linux/of.h>
>  #include <linux/ima.h>
> +#include <linux/mm.h>
> +#include <linux/overflow.h>
>  #include <linux/reboot.h>
>  #include <asm/page.h>
>  #include "ima.h"
> @@ -296,3 +298,36 @@ void __init ima_load_kexec_buffer(void)
>  		pr_debug("Error restoring the measurement list: %d\n", rc);
>  	}
>  }
> +
> +/*
> + * ima_validate_range - verify a physical buffer lies in addressable RAM
> + * @phys: physical start address of the buffer from previous kernel
> + * @size: size of the buffer
> + *
> + * On success return 0. On failure returns -EINVAL so callers can skip
> + * restoring.
> + */
> +int ima_validate_range(phys_addr_t phys, size_t size)
> +{
> +	unsigned long start_pfn, end_pfn;
> +	phys_addr_t end_phys;
> +
> +	if (check_add_overflow(phys, (phys_addr_t)size - 1, &end_phys))
> +		return -EINVAL;
> +
> +	start_pfn = PHYS_PFN(phys);
> +	end_pfn = PHYS_PFN(end_phys);
> +
> +#ifdef CONFIG_X86
> +	if (!pfn_range_is_mapped(start_pfn, end_pfn))
> +#else
> +	if (!page_is_ram(start_pfn) || !page_is_ram(end_pfn))
> +#endif
> +	{
> +		pr_warn("IMA: previous kernel measurement buffer %pa (size 0x%zx) lies outside available memory\n",
> +			&phys, size);
> +		return -EINVAL;
> +	}
> +
> +	return 0;
> +}