If writing to the configfs group happens concurrently during
kexec_file_load syscall, it may lead to the following issues,
- buffer overflow if dm-crypt keys are added after allocation
- stale total_keys if dm-crypt keys are removed during iteration
- keys_header will not be freed if config/crash_dm_crypt_key/reuse is
set true
So hold config_keys_subsys.su_mutex for the entire sequence during the
kexec_file_load syscall to ensure a consistent snapshot. To have serial
access to config/crash_dm_crypt_key/reuse, use the kexec lock as we also
need to access kexec_crash_image serially.
Fixes: 479e58549b0f ("crash_dump: store dm crypt keys in kdump reserved memory")
Suggested-by: Sourabh Jain <[email protected]>
Signed-off-by: Coiby Xu <[email protected]>
---
kernel/crash_dump_dm_crypt.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c
index 3a416933979f..580534d43b66 100644
--- a/kernel/crash_dump_dm_crypt.c
+++ b/kernel/crash_dump_dm_crypt.c
@@ -7,6 +7,7 @@
#include <linux/configfs.h>
#include <linux/module.h>
#include <linux/sysfs.h>
+#include "kexec_internal.h"
#define KEY_NUM_MAX 128 /* maximum dm crypt keys */
#define KEY_SIZE_MAX 256 /* maximum dm crypt key size */
@@ -306,14 +307,20 @@ static ssize_t config_keys_reuse_store(struct config_item
*item,
bool val;
int r;
+ if (!kexec_trylock()) {
+ pr_warn("Failed to acquire the kexec lock\n");
+ return -EBUSY;
+ }
+
+ r = -EINVAL;
if (!kexec_crash_image || !kexec_crash_image->dm_crypt_keys_addr) {
kexec_dprintk(
"dm-crypt keys haven't be saved to crash-reserved
memory\n");
- return -EINVAL;
+ goto unlock;
}
if (kstrtobool(page, &val) || !val)
- return -EINVAL;
+ goto unlock;
if (is_dm_key_reused) {
pr_info("Already got dm-crypt keys, please continue with
kexec_file_load syscall\n");
@@ -321,12 +328,15 @@ static ssize_t config_keys_reuse_store(struct config_item
*item,
r = get_keys_from_kdump_reserved_memory();
if (r) {
pr_warn("Failed to get dm-crypt keys from reserved
memory\n");
- return r;
+ goto unlock;
}
is_dm_key_reused = true;
}
- return count;
+ r = count;
+unlock:
+ kexec_unlock();
+ return r;
}
CONFIGFS_ATTR(config_keys_, reuse);
@@ -443,15 +453,17 @@ int crash_load_dm_crypt_keys(struct kimage *image)
int r = 0;
if (!is_dm_key_reused) {
+ mutex_lock(&config_keys_subsys.su_mutex);
+
if (key_count <= 0) {
kexec_dprintk("No dm-crypt keys\n");
r = 0;
- goto out;
+ goto unlock;
}
r = build_keys_header();
if (r)
- goto out;
+ goto unlock;
}
/*
@@ -478,6 +490,9 @@ int crash_load_dm_crypt_keys(struct kimage *image)
"Loaded dm crypt keys to kexec_buffer bufsz=0x%lx
memsz=0x%lx\n",
kbuf.bufsz, kbuf.memsz);
+unlock:
+ mutex_unlock(&config_keys_subsys.su_mutex);
+
out:
is_dm_key_reused = false;
return r;
--
2.55.0
