Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <74c0d1b900d8f518bc152478682a353c29e0faa3.camel@surriel.com>
Subject: Re: [PATCH] mm,ima,kexec: use memblock_free_late from
 ima_free_kexec_buffer
From:   Rik van Riel <riel@surriel.com>
To:     Rob Herring <robh@kernel.org>
Cc:     linux-kernel@vger.kernel.org, kernel-team@meta.com,
        Mike Rapoport <rppt@kernel.org>, devicetree@vger.kernel.org,
        x86@kernel.org, Juergen Gross <jgross@suse.com>,
        Dave Hansen <dave.hansen@linux.intel.com>
Date:   Fri, 21 Jul 2023 20:40:41 -0400
In-Reply-To: <20230721193815.GA1679711-robh@kernel.org>
References: <20230720101431.71640c8a@imladris.surriel.com>
         <20230721193815.GA1679711-robh@kernel.org>
Content-Type: multipart/signed; micalg="pgp-sha256";
        protocol="application/pgp-signature"; boundary="=-arL+6ARjPI5tJ5FA86BZ"
User-Agent: Evolution 3.46.4 (3.46.4-1.fc37) 
MIME-Version: 1.0
Sender: riel@surriel.com
Precedence: bulk


--=-arL+6ARjPI5tJ5FA86BZ
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, 2023-07-21 at 13:38 -0600, Rob Herring wrote:
> On Thu, Jul 20, 2023 at 10:14:31AM -0400, Rik van Riel wrote:
> > The code calling ima_free_kexec_buffer runs long after the memblock
> > allocator has already been torn down, potentially resulting in a
> > use
> > after free in memblock_isolate_range.
> >=20
> > With KASAN or KFENCE, this use after free will result in a BUG
> > from the idle task, and a subsequent kernel panic.
> >=20
> > Switch ima_free_kexec_buffer over to memblock_free_late to avoid
> > that issue.
> >=20
> > Fixes: fee3ff99bc67 ("powerpc: Move arch independent ima kexec
> > functions to drivers/of/kexec.c")
>=20
> Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on
> kexec")
>=20
Thank you for digging further back in the history of that code.

> Acked-by: Rob Herring <robh@kernel.org>
>=20
> (I'm assuming someone else is taking this)

I hope so, but I don't know who...

--=20
All Rights Reversed.

--=-arL+6ARjPI5tJ5FA86BZ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQEzBAABCAAdFiEEKR73pCCtJ5Xj3yADznnekoTE3oMFAmS7JYkACgkQznnekoTE
3oNweggAoTeYhkK7Bv29fhN4TQ3HPkHD/lkY8tc+Kul8fw1jvDSGfWdYOj8oB1hb
WyDd+U2i0hJvA4ox324sIHxhjx3+WfZgWwRVu8yTB13WjgM6Z+7LaBMvhbHGXq+W
bihdg26uumxREuF8slsvxAnhVIC5ZRbfGXFnvTo7T3ufJ7xSHT82WF+2+Zp6S7gs
9kMFRrnb1lafUBomKHm/g4iaFxDTYYxPt73aJzPEXBSDwkjuGiJpUoLKgH5X3u/o
6WI1/2UMzJR+K3dCI1ps6pZSG++JfR64OZDvKKR/SqbOW2yhtCING16b4SbD3HjA
GGvP+81Bg3iZdWZCdmhRsA5AZ3t0oA==
=6DM6
-----END PGP SIGNATURE-----

--=-arL+6ARjPI5tJ5FA86BZ--