Received-SPF: pass (google.com: domain of linux-kernel+bounces-184468-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Tue, 21 May 2024 11:42:52 +0800
From: Baoquan He <bhe@redhat.com>
To: Coiby Xu <coxu@redhat.com>
Cc: kexec@lists.infradead.org, Ondrej Kozina <okozina@redhat.com>,
	Milan Broz <gmazyland@gmail.com>,
	Thomas Staudt <tstaudt@de.ibm.com>,
	Daniel P =?iso-8859-1?Q?=2E_Berrang=E9?= <berrange@redhat.com>,
	Kairui Song <ryncsn@gmail.com>,
	 Jan Pazdziora <jpazdziora@redhat.com>,
	Pingfan Liu <kernelfans@gmail.com>, Dave Young <dyoung@redhat.com>,
	linux-kernel@vger.kernel.org, x86@kernel.org,
	Dave Hansen <dave.hansen@intel.com>,
	Vitaly Kuznetsov <vkuznets@redhat.com>,
	Vivek Goyal <vgoyal@redhat.com>,
	Eric Biederman <ebiederm@xmission.com>
Subject: Re: [PATCH v3 3/7] crash_dump: store dm keys in kdump reserved memory
Message-ID: <ZkwYIf2YgDfSZ1y8@MiWiFi-R3L-srv>
References: <20240425100434.198925-1-coxu@redhat.com>
 <20240425100434.198925-4-coxu@redhat.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240425100434.198925-4-coxu@redhat.com>

On 04/25/24 at 06:04pm, Coiby Xu wrote:
> When the kdump kernel image and initrd are loaded, the dm crypts keys
> will be read from keyring and then stored in kdump reserved memory.
> 
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---
>  include/linux/crash_core.h   |  3 ++
>  include/linux/crash_dump.h   |  2 +
>  include/linux/kexec.h        |  4 ++
>  kernel/crash_dump_dm_crypt.c | 87 ++++++++++++++++++++++++++++++++++++
>  4 files changed, 96 insertions(+)
> 
> diff --git a/include/linux/crash_core.h b/include/linux/crash_core.h
> index 98825b7e0ea6..1f3d5a4fa6c1 100644
> --- a/include/linux/crash_core.h
> +++ b/include/linux/crash_core.h
> @@ -37,6 +37,9 @@ static inline void arch_kexec_unprotect_crashkres(void) { }
>  #ifdef CONFIG_CRASH_DM_CRYPT
>  int crash_sysfs_dm_crypt_keys_read(char *buf);
>  int crash_sysfs_dm_crypt_keys_write(const char *buf, size_t count);
> +int crash_load_dm_crypt_keys(struct kimage *image);
> +#else
> +static inline int crash_load_dm_crypt_keys(struct kimage *image) {return 0; }
>  #endif
>  
>  #ifndef arch_crash_handle_hotplug_event
> diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
> index acc55626afdc..dfd8e4fe6129 100644
> --- a/include/linux/crash_dump.h
> +++ b/include/linux/crash_dump.h
> @@ -15,6 +15,8 @@
>  extern unsigned long long elfcorehdr_addr;
>  extern unsigned long long elfcorehdr_size;
>  
> +extern unsigned long long dm_crypt_keys_addr;
> +
>  #ifdef CONFIG_CRASH_DUMP
>  extern int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size);
>  extern void elfcorehdr_free(unsigned long long addr);
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index fc1e20d565d5..b6cedce66828 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -368,6 +368,10 @@ struct kimage {
>  	void *elf_headers;
>  	unsigned long elf_headers_sz;
>  	unsigned long elf_load_addr;
> +
> +	/* dm crypt keys buffer */
> +	unsigned long dm_crypt_keys_addr;
> +	unsigned long dm_crypt_keys_sz;
>  };
>  
>  /* kexec interface functions */
> diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c
> index 847499cdcd42..b9997fb53351 100644
> --- a/kernel/crash_dump_dm_crypt.c
> +++ b/kernel/crash_dump_dm_crypt.c
> @@ -1,4 +1,6 @@
>  // SPDX-License-Identifier: GPL-2.0-only
> +#include <linux/key.h>
> +#include <linux/keyctl.h>
>  #include <keys/user-type.h>
>  #include <linux/crash_dump.h>
>  
> @@ -111,3 +113,88 @@ int crash_sysfs_dm_crypt_keys_read(char *buf)
>  	return sprintf(buf, "%s\n", STATE_STR[state]);
>  }
>  EXPORT_SYMBOL(crash_sysfs_dm_crypt_keys_read);
> +
> +static int read_key_from_user_keying(struct dm_crypt_key *dm_key)
> +{
> +	const struct user_key_payload *ukp;
> +	struct key *key;
> +
> +	pr_debug("Requesting key %s", dm_key->key_desc);
> +	key = request_key(&key_type_logon, dm_key->key_desc, NULL);
> +
> +	if (IS_ERR(key)) {
> +		pr_warn("No such key %s\n", dm_key->key_desc);
> +		return PTR_ERR(key);
> +	}
> +
> +	ukp = user_key_payload_locked(key);
> +	if (!ukp)
> +		return -EKEYREVOKED;
> +
> +	memcpy(dm_key->data, ukp->data, ukp->datalen);
> +	dm_key->key_size = ukp->datalen;
> +	pr_debug("Get dm crypt key (size=%u) %s: %8ph\n", dm_key->key_size,
> +		 dm_key->key_desc, dm_key->data);
> +	return 0;
> +}
> +
> +static int build_keys_header(void)
> +{
> +	int i, r;
> +
> +	for (i = 0; i < key_count; i++) {
> +		r = read_key_from_user_keying(&keys_header->keys[i]);
> +		if (r != 0) {
> +			pr_err("Failed to read key %s\n", keys_header->keys[i].key_desc);
> +			return r;
> +		}
> +	}
> +
> +	return 0;
> +}
> +
> +int crash_load_dm_crypt_keys(struct kimage *image)
> +{
> +	struct kexec_buf kbuf = {
> +		.image = image,
> +		.buf_min = 0,
> +		.buf_max = ULONG_MAX,
> +		.top_down = false,
> +		.random = true,
> +	};
> +
> +	int r;
> +
> +	if (state == FRESH)
> +		return 0;
> +
> +	if (key_count != keys_header->key_count) {
> +		pr_err("Only record %u keys (%u in total)\n", key_count,
> +		       keys_header->key_count);
> +		return -EINVAL;
> +	}
> +
> +	image->dm_crypt_keys_addr = 0;
> +	r = build_keys_header();
> +	if (r)
> +		return r;
> +
> +	kbuf.buffer = keys_header;
> +	kbuf.bufsz = keys_header_size;
> +
> +	kbuf.memsz = kbuf.bufsz;
> +	kbuf.buf_align = ELF_CORE_HEADER_ALIGN;
> +	kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
> +	r = kexec_add_buffer(&kbuf);
> +	if (r) {
> +		vfree((void *)kbuf.buffer);
> +		return r;
> +	}
> +	state = LOADED;
> +	image->dm_crypt_keys_addr = kbuf.mem;
> +	image->dm_crypt_keys_sz = kbuf.bufsz;
> +	pr_debug("Loaded dm crypt keys at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
> +		 image->dm_crypt_keys_addr, kbuf.bufsz, kbuf.bufsz);

Please use kexec_dprintk() instead to print debugging message.

And you don't worry this printing will leak the key position and the
information? 

> +
> +	return r;
> +}
> -- 
> 2.44.0
>