github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 01:53:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

x86/crash: make the page that stores the dm crypt keys inaccessible

Browse Source 
This adds an addition layer of protection for the saved copy of dm crypt
key.  Trying to access the saved copy will cause page fault.

Link: https://lkml.kernel.org/r/20250502011246.99238-9-coxu@redhat.com
Signed-off-by: Coiby Xu <coxu@redhat.com>
Suggested-by: Pingfan Liu <kernelfans@gmail.com>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: "Daniel P. Berrange" <berrange@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Jan Pazdziora <jpazdziora@redhat.com>
Cc: Milan Broz <gmazyland@gmail.com>
Cc: Ondrej Kozina <okozina@redhat.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Coiby Xu 2025-05-02 09:12:42 +08:00 committed by Andrew Morton
parent 5eb3f60554
commit cc66e4863a
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
arch/x86/kernel/machine_kexec_64.c
View File

@ -598,13 +598,35 @@ static void kexec_mark_crashkres(bool protect)
kexec_mark_range(control, crashk_res.end, protect);
}
/* make the memory storing dm crypt keys in/accessible */
static void kexec_mark_dm_crypt_keys(bool protect)
{
unsigned long start_paddr, end_paddr;
unsigned int nr_pages;
if (kexec_crash_image->dm_crypt_keys_addr) {
start_paddr = kexec_crash_image->dm_crypt_keys_addr;
end_paddr = start_paddr + kexec_crash_image->dm_crypt_keys_sz - 1;
nr_pages = (PAGE_ALIGN(end_paddr) - PAGE_ALIGN_DOWN(start_paddr))/PAGE_SIZE;
if (protect)
set_memory_np((unsigned long)phys_to_virt(start_paddr), nr_pages);
else
__set_memory_prot(
(unsigned long)phys_to_virt(start_paddr),
nr_pages,
__pgprot(_PAGE_PRESENT | _PAGE_NX | _PAGE_RW));
}
}
void arch_kexec_protect_crashkres(void)
{
kexec_mark_crashkres(true);
kexec_mark_dm_crypt_keys(true);
}
void arch_kexec_unprotect_crashkres(void)
{
kexec_mark_dm_crypt_keys(false);
kexec_mark_crashkres(false);
}
#endif