[v2,2/5] crash_dump: save the dm crypt key temporarily
Commit Message
User space is supposed to write the key description to
/sys/kernel/crash_dm_crypt_key so the kernel will read the key and save
a temporary copy for later user. User space has 2 minutes at maximum to
load the kdump initrd before the key gets wiped. And after kdump
retrieves the key, the key will be wiped immediately.
Signed-off-by: Coiby Xu <coxu@redhat.com>
---
include/linux/crash_core.h | 7 +-
include/linux/kexec.h | 4 ++
kernel/Makefile | 2 +-
kernel/crash_dump_dm_crypt.c | 121 +++++++++++++++++++++++++++++++++++
kernel/ksysfs.c | 23 ++++++-
5 files changed, 153 insertions(+), 4 deletions(-)
create mode 100644 kernel/crash_dump_dm_crypt.c
Comments
Hi Coiby,
kernel test robot noticed the following build errors:
[auto build test ERROR on tip/x86/core]
[also build test ERROR on v6.7]
[cannot apply to linus/master next-20240112]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Coiby-Xu/kexec_file-allow-to-place-kexec_buf-randomly/20240110-151859
base: tip/x86/core
patch link: https://lore.kernel.org/r/20240110071522.1308935-3-coxu%40redhat.com
patch subject: [PATCH v2 2/5] crash_dump: save the dm crypt key temporarily
config: i386-buildonly-randconfig-003-20240113 (https://download.01.org/0day-ci/archive/20240114/202401140034.Sh6fQaK6-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240114/202401140034.Sh6fQaK6-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202401140034.Sh6fQaK6-lkp@intel.com/
All error/warnings (new ones prefixed by >>):
>> kernel/crash_dump_dm_crypt.c:8:6: warning: no previous prototype for 'wipe_dm_crypt_key' [-Wmissing-prototypes]
8 | void wipe_dm_crypt_key(void)
| ^~~~~~~~~~~~~~~~~
kernel/crash_dump_dm_crypt.c: In function 'crash_load_dm_crypt_key':
>> kernel/crash_dump_dm_crypt.c:94:16: error: variable 'kbuf' has initializer but incomplete type
94 | struct kexec_buf kbuf = {
| ^~~~~~~~~
>> kernel/crash_dump_dm_crypt.c:95:18: error: 'struct kexec_buf' has no member named 'image'
95 | .image = image,
| ^~~~~
>> kernel/crash_dump_dm_crypt.c:95:26: warning: excess elements in struct initializer
95 | .image = image,
| ^~~~~
kernel/crash_dump_dm_crypt.c:95:26: note: (near initialization for 'kbuf')
>> kernel/crash_dump_dm_crypt.c:96:18: error: 'struct kexec_buf' has no member named 'buf_min'
96 | .buf_min = 0,
| ^~~~~~~
kernel/crash_dump_dm_crypt.c:96:28: warning: excess elements in struct initializer
96 | .buf_min = 0,
| ^
kernel/crash_dump_dm_crypt.c:96:28: note: (near initialization for 'kbuf')
>> kernel/crash_dump_dm_crypt.c:97:18: error: 'struct kexec_buf' has no member named 'buf_max'
97 | .buf_max = ULONG_MAX,
| ^~~~~~~
In file included from include/linux/limits.h:7,
from include/linux/kernel.h:17,
from arch/x86/include/asm/percpu.h:27,
from arch/x86/include/asm/nospec-branch.h:14,
from arch/x86/include/asm/irqflags.h:9,
from include/linux/irqflags.h:17,
from include/linux/rcupdate.h:26,
from include/linux/rbtree.h:24,
from include/linux/key.h:15,
from include/keys/user-type.h:11,
from kernel/crash_dump_dm_crypt.c:2:
>> include/vdso/limits.h:13:25: warning: excess elements in struct initializer
13 | #define ULONG_MAX (~0UL)
| ^
kernel/crash_dump_dm_crypt.c:97:28: note: in expansion of macro 'ULONG_MAX'
97 | .buf_max = ULONG_MAX,
| ^~~~~~~~~
include/vdso/limits.h:13:25: note: (near initialization for 'kbuf')
13 | #define ULONG_MAX (~0UL)
| ^
kernel/crash_dump_dm_crypt.c:97:28: note: in expansion of macro 'ULONG_MAX'
97 | .buf_max = ULONG_MAX,
| ^~~~~~~~~
>> kernel/crash_dump_dm_crypt.c:98:18: error: 'struct kexec_buf' has no member named 'top_down'
98 | .top_down = false,
| ^~~~~~~~
kernel/crash_dump_dm_crypt.c:98:29: warning: excess elements in struct initializer
98 | .top_down = false,
| ^~~~~
kernel/crash_dump_dm_crypt.c:98:29: note: (near initialization for 'kbuf')
>> kernel/crash_dump_dm_crypt.c:99:18: error: 'struct kexec_buf' has no member named 'random'
99 | .random = true,
| ^~~~~~
kernel/crash_dump_dm_crypt.c:99:27: warning: excess elements in struct initializer
99 | .random = true,
| ^~~~
kernel/crash_dump_dm_crypt.c:99:27: note: (near initialization for 'kbuf')
>> kernel/crash_dump_dm_crypt.c:94:26: error: storage size of 'kbuf' isn't known
94 | struct kexec_buf kbuf = {
| ^~~~
>> kernel/crash_dump_dm_crypt.c:109:20: error: 'KEXEC_BUF_MEM_UNKNOWN' undeclared (first use in this function)
109 | kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
| ^~~~~~~~~~~~~~~~~~~~~
kernel/crash_dump_dm_crypt.c:109:20: note: each undeclared identifier is reported only once for each function it appears in
>> kernel/crash_dump_dm_crypt.c:110:15: error: implicit declaration of function 'kexec_add_buffer' [-Werror=implicit-function-declaration]
110 | ret = kexec_add_buffer(&kbuf);
| ^~~~~~~~~~~~~~~~
>> kernel/crash_dump_dm_crypt.c:94:26: warning: unused variable 'kbuf' [-Wunused-variable]
94 | struct kexec_buf kbuf = {
| ^~~~
cc1: some warnings being treated as errors
vim +/kbuf +94 kernel/crash_dump_dm_crypt.c
7
> 8 void wipe_dm_crypt_key(void)
9 {
10 if (dm_crypt_key) {
11 memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
12 kfree(dm_crypt_key);
13 dm_crypt_key = NULL;
14 }
15 }
16
17 static void _wipe_dm_crypt_key(struct work_struct *dummy)
18 {
19 wipe_dm_crypt_key();
20 }
21
22 static DECLARE_DELAYED_WORK(wipe_dm_crypt_key_work, _wipe_dm_crypt_key);
23
24 static unsigned __read_mostly wipe_key_delay = 120; /* 2 mins */
25
26 static int crash_save_temp_dm_crypt_key(const char *key_desc, size_t count)
27 {
28 const struct user_key_payload *ukp;
29 struct key *key;
30
31 if (dm_crypt_key) {
32 memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
33 kfree(dm_crypt_key);
34 }
35
36 pr_debug("Requesting key %s", key_desc);
37 key = request_key(&key_type_user, key_desc, NULL);
38
39 if (IS_ERR(key)) {
40 pr_debug("No such key %s", key_desc);
41 return PTR_ERR(key);
42 }
43
44 ukp = user_key_payload_locked(key);
45 if (!ukp)
46 return -EKEYREVOKED;
47
48 dm_crypt_key = kmalloc(ukp->datalen, GFP_KERNEL);
49 if (!dm_crypt_key)
50 return -ENOMEM;
51 memcpy(dm_crypt_key, ukp->data, ukp->datalen);
52 dm_crypt_key_size = ukp->datalen;
53 pr_debug("dm crypt key (size=%u): %8ph\n", dm_crypt_key_size, dm_crypt_key);
54 schedule_delayed_work(&wipe_dm_crypt_key_work,
55 round_jiffies_relative(wipe_key_delay * HZ));
56 return 0;
57 }
58
59 int crash_sysfs_dm_crypt_key_write(const char *key_desc, size_t count)
60 {
61 if (!is_kdump_kernel())
62 return crash_save_temp_dm_crypt_key(key_desc, count);
63 return -EINVAL;
64 }
65 EXPORT_SYMBOL(crash_sysfs_dm_crypt_key_write);
66
67 int crash_pass_temp_dm_crypt_key(void **addr, unsigned long *sz)
68 {
69 unsigned long dm_crypt_key_sz;
70 unsigned char *buf;
71 unsigned int *size_ptr;
72
73 if (!dm_crypt_key)
74 return -EINVAL;
75
76 dm_crypt_key_sz = sizeof(unsigned int) + dm_crypt_key_size * sizeof(u8);
77
78 buf = vzalloc(dm_crypt_key_sz);
79 if (!buf)
80 return -ENOMEM;
81
82 size_ptr = (unsigned int *)buf;
83 memcpy(size_ptr, &dm_crypt_key_size, sizeof(unsigned int));
84 memcpy(size_ptr + 1, dm_crypt_key, dm_crypt_key_size * sizeof(u8));
85 *addr = buf;
86 *sz = dm_crypt_key_sz;
87 wipe_dm_crypt_key();
88 return 0;
89 }
90
91 int crash_load_dm_crypt_key(struct kimage *image)
92 {
93 int ret;
> 94 struct kexec_buf kbuf = {
> 95 .image = image,
> 96 .buf_min = 0,
> 97 .buf_max = ULONG_MAX,
> 98 .top_down = false,
> 99 .random = true,
100 };
101
102 image->dm_crypt_key_addr = 0;
103 ret = crash_pass_temp_dm_crypt_key(&kbuf.buffer, &kbuf.bufsz);
104 if (ret)
105 return ret;
106
107 kbuf.memsz = kbuf.bufsz;
108 kbuf.buf_align = ELF_CORE_HEADER_ALIGN;
> 109 kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
> 110 ret = kexec_add_buffer(&kbuf);
Hi Coiby,
kernel test robot noticed the following build errors:
[auto build test ERROR on tip/x86/core]
[also build test ERROR on v6.7]
[cannot apply to linus/master next-20240112]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Coiby-Xu/kexec_file-allow-to-place-kexec_buf-randomly/20240110-151859
base: tip/x86/core
patch link: https://lore.kernel.org/r/20240110071522.1308935-3-coxu%40redhat.com
patch subject: [PATCH v2 2/5] crash_dump: save the dm crypt key temporarily
config: i386-buildonly-randconfig-002-20240113 (https://download.01.org/0day-ci/archive/20240114/202401140128.MBysmTaN-lkp@intel.com/config)
compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240114/202401140128.MBysmTaN-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202401140128.MBysmTaN-lkp@intel.com/
All errors (new ones prefixed by >>):
ld: kernel/ksysfs.o: in function `crash_dm_crypt_key_store':
>> ksysfs.c:(.text+0x2d0): undefined reference to `crash_sysfs_dm_crypt_key_write'
Hi Coiby,
kernel test robot noticed the following build warnings:
[auto build test WARNING on tip/x86/core]
[also build test WARNING on v6.7]
[cannot apply to linus/master next-20240112]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Coiby-Xu/kexec_file-allow-to-place-kexec_buf-randomly/20240110-151859
base: tip/x86/core
patch link: https://lore.kernel.org/r/20240110071522.1308935-3-coxu%40redhat.com
patch subject: [PATCH v2 2/5] crash_dump: save the dm crypt key temporarily
config: x86_64-randconfig-123-20240114 (https://download.01.org/0day-ci/archive/20240114/202401140506.JQu60mgM-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240114/202401140506.JQu60mgM-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202401140506.JQu60mgM-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> kernel/crash_dump_dm_crypt.c:8:6: sparse: sparse: symbol 'wipe_dm_crypt_key' was not declared. Should it be static?
kernel/crash_dump_dm_crypt.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/mm.h, ...):
include/linux/page-flags.h:242:46: sparse: sparse: self-comparison always evaluates to false
vim +/wipe_dm_crypt_key +8 kernel/crash_dump_dm_crypt.c
7
> 8 void wipe_dm_crypt_key(void)
9 {
10 if (dm_crypt_key) {
11 memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
12 kfree(dm_crypt_key);
13 dm_crypt_key = NULL;
14 }
15 }
16
On 10/01/2024 08:15, Coiby Xu wrote:
> User space is supposed to write the key description to
> /sys/kernel/crash_dm_crypt_key so the kernel will read the key and save
> a temporary copy for later user. User space has 2 minutes at maximum to
> load the kdump initrd before the key gets wiped. And after kdump
> retrieves the key, the key will be wiped immediately.
>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> ---
> include/linux/crash_core.h | 7 +-
> include/linux/kexec.h | 4 ++
> kernel/Makefile | 2 +-
> kernel/crash_dump_dm_crypt.c | 121 +++++++++++++++++++++++++++++++++++
> kernel/ksysfs.c | 23 ++++++-
> 5 files changed, 153 insertions(+), 4 deletions(-)
> create mode 100644 kernel/crash_dump_dm_crypt.c
>
> diff --git a/include/linux/crash_core.h b/include/linux/crash_core.h
> index 5126a4fecb44..7078eda6418d 100644
> --- a/include/linux/crash_core.h
> +++ b/include/linux/crash_core.h
> @@ -125,6 +125,12 @@ static inline void __init reserve_crashkernel_generic(char *cmdline,
> {}
> #endif
>
> +struct kimage;
> +
> +int crash_sysfs_dm_crypt_key_write(const char *key_des, size_t count);
> +int crash_pass_temp_dm_crypt_key(void **addr, unsigned long *sz);
> +int crash_load_dm_crypt_key(struct kimage *image);
> +
> /* Alignment required for elf header segment */
> #define ELF_CORE_HEADER_ALIGN 4096
>
> @@ -140,7 +146,6 @@ extern int crash_exclude_mem_range(struct crash_mem *mem,
> extern int crash_prepare_elf64_headers(struct crash_mem *mem, int need_kernel_map,
> void **addr, unsigned long *sz);
>
> -struct kimage;
> struct kexec_segment;
>
> #define KEXEC_CRASH_HP_NONE 0
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index 6f4626490ebf..bf7ab1e927ef 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -366,6 +366,10 @@ struct kimage {
> void *elf_headers;
> unsigned long elf_headers_sz;
> unsigned long elf_load_addr;
> +
> + /* dm crypt key buffer */
> + unsigned long dm_crypt_key_addr;
> + unsigned long dm_crypt_key_sz;
> };
>
> /* kexec interface functions */
> diff --git a/kernel/Makefile b/kernel/Makefile
> index 3947122d618b..48859bf63db5 100644
> --- a/kernel/Makefile
> +++ b/kernel/Makefile
> @@ -119,7 +119,7 @@ obj-$(CONFIG_PERF_EVENTS) += events/
>
> obj-$(CONFIG_USER_RETURN_NOTIFIER) += user-return-notifier.o
> obj-$(CONFIG_PADATA) += padata.o
> -obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
> +obj-$(CONFIG_CRASH_DUMP) += crash_dump.o crash_dump_dm_crypt.o
> obj-$(CONFIG_JUMP_LABEL) += jump_label.o
> obj-$(CONFIG_CONTEXT_TRACKING) += context_tracking.o
> obj-$(CONFIG_TORTURE_TEST) += torture.o
> diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c
> new file mode 100644
> index 000000000000..3a0b0b773598
> --- /dev/null
> +++ b/kernel/crash_dump_dm_crypt.c
> @@ -0,0 +1,121 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +#include <keys/user-type.h>
> +#include <linux/crash_dump.h>
> +
> +static u8 *dm_crypt_key;
> +static unsigned int dm_crypt_key_size;
> +
> +void wipe_dm_crypt_key(void)
> +{
> + if (dm_crypt_key) {
> + memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
> + kfree(dm_crypt_key);
> + dm_crypt_key = NULL;
> + }
> +}
> +
> +static void _wipe_dm_crypt_key(struct work_struct *dummy)
> +{
> + wipe_dm_crypt_key();
> +}
> +
> +static DECLARE_DELAYED_WORK(wipe_dm_crypt_key_work, _wipe_dm_crypt_key);
> +
> +static unsigned __read_mostly wipe_key_delay = 120; /* 2 mins */
> +
> +static int crash_save_temp_dm_crypt_key(const char *key_desc, size_t count)
> +{
> + const struct user_key_payload *ukp;
> + struct key *key;
> +
> + if (dm_crypt_key) {
> + memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
> + kfree(dm_crypt_key);
> + }
> +
> + pr_debug("Requesting key %s", key_desc);
> + key = request_key(&key_type_user, key_desc, NULL);
If we don't read the key copy form userspace (my reply to top level
message) you could use key_type_logon here.
> +
> + if (IS_ERR(key)) {
> + pr_debug("No such key %s", key_desc);
> + return PTR_ERR(key);
> + }
> +
> + ukp = user_key_payload_locked(key);
> + if (!ukp)
> + return -EKEYREVOKED;
> +
> + dm_crypt_key = kmalloc(ukp->datalen, GFP_KERNEL);
> + if (!dm_crypt_key)
> + return -ENOMEM;
> + memcpy(dm_crypt_key, ukp->data, ukp->datalen);
> + dm_crypt_key_size = ukp->datalen;
> + pr_debug("dm crypt key (size=%u): %8ph\n", dm_crypt_key_size, dm_crypt_key);
> + schedule_delayed_work(&wipe_dm_crypt_key_work,
> + round_jiffies_relative(wipe_key_delay * HZ));
> + return 0;
> +}
> +
> +int crash_sysfs_dm_crypt_key_write(const char *key_desc, size_t count)
> +{
> + if (!is_kdump_kernel())
> + return crash_save_temp_dm_crypt_key(key_desc, count);
> + return -EINVAL;
> +}
> +EXPORT_SYMBOL(crash_sysfs_dm_crypt_key_write);
> +
> +int crash_pass_temp_dm_crypt_key(void **addr, unsigned long *sz)
> +{
> + unsigned long dm_crypt_key_sz;
> + unsigned char *buf;
> + unsigned int *size_ptr;
> +
> + if (!dm_crypt_key)
> + return -EINVAL;
> +
> + dm_crypt_key_sz = sizeof(unsigned int) + dm_crypt_key_size * sizeof(u8);
> +
> + buf = vzalloc(dm_crypt_key_sz);
> + if (!buf)
> + return -ENOMEM;
> +
> + size_ptr = (unsigned int *)buf;
> + memcpy(size_ptr, &dm_crypt_key_size, sizeof(unsigned int));
> + memcpy(size_ptr + 1, dm_crypt_key, dm_crypt_key_size * sizeof(u8));
> + *addr = buf;
> + *sz = dm_crypt_key_sz;
> + wipe_dm_crypt_key();
> + return 0;
> +}
> +
> +int crash_load_dm_crypt_key(struct kimage *image)
> +{
> + int ret;
> + struct kexec_buf kbuf = {
> + .image = image,
> + .buf_min = 0,
> + .buf_max = ULONG_MAX,
> + .top_down = false,
> + .random = true,
> + };
> +
> + image->dm_crypt_key_addr = 0;
> + ret = crash_pass_temp_dm_crypt_key(&kbuf.buffer, &kbuf.bufsz);
> + if (ret)
> + return ret;
> +
> + kbuf.memsz = kbuf.bufsz;
> + kbuf.buf_align = ELF_CORE_HEADER_ALIGN;
> + kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
> + ret = kexec_add_buffer(&kbuf);
> + if (ret) {
> + vfree((void *)kbuf.buffer);
> + return ret;
> + }
> + image->dm_crypt_key_addr = kbuf.mem;
> + image->dm_crypt_key_sz = kbuf.bufsz;
> + pr_debug("Loaded dm crypt key at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
> + image->dm_crypt_key_addr, kbuf.bufsz, kbuf.bufsz);
> +
> + return ret;
> +}
> diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
> index 1d4bc493b2f4..f3bb6bc6a604 100644
> --- a/kernel/ksysfs.c
> +++ b/kernel/ksysfs.c
> @@ -165,16 +165,34 @@ static ssize_t vmcoreinfo_show(struct kobject *kobj,
> }
> KERNEL_ATTR_RO(vmcoreinfo);
>
> +static ssize_t crash_dm_crypt_key_show(struct kobject *kobj,
> + struct kobj_attribute *attr,
> + char *buf)
> +{
> + return 0;
> +}
> +
> +static ssize_t crash_dm_crypt_key_store(struct kobject *kobj,
> + struct kobj_attribute *attr,
> + const char *buf, size_t count)
> +{
> + int ret;
> +
> + ret = crash_sysfs_dm_crypt_key_write(buf, count);
> + return ret < 0 ? ret : count;
> +}
> +KERNEL_ATTR_RW(crash_dm_crypt_key);
> +
> #ifdef CONFIG_CRASH_HOTPLUG
> static ssize_t crash_elfcorehdr_size_show(struct kobject *kobj,
> - struct kobj_attribute *attr, char *buf)
> + struct kobj_attribute *attr,
> + char *buf)
> {
> unsigned int sz = crash_get_elfcorehdr_size();
>
> return sysfs_emit(buf, "%u\n", sz);
> }
> KERNEL_ATTR_RO(crash_elfcorehdr_size);
> -
> #endif
>
> #endif /* CONFIG_CRASH_CORE */
> @@ -267,6 +285,7 @@ static struct attribute * kernel_attrs[] = {
> #endif
> #ifdef CONFIG_CRASH_CORE
> &vmcoreinfo_attr.attr,
> + &crash_dm_crypt_key_attr.attr,
> #ifdef CONFIG_CRASH_HOTPLUG
> &crash_elfcorehdr_size_attr.attr,
> #endif
On Tue, Jan 16, 2024 at 11:40:53AM +0100, Ondrej Kozina wrote:
>On 10/01/2024 08:15, Coiby Xu wrote:
>>User space is supposed to write the key description to
>>/sys/kernel/crash_dm_crypt_key so the kernel will read the key and save
>>a temporary copy for later user. User space has 2 minutes at maximum to
>>load the kdump initrd before the key gets wiped. And after kdump
>>retrieves the key, the key will be wiped immediately.
>>
>>Signed-off-by: Coiby Xu <coxu@redhat.com>
>>---
>> include/linux/crash_core.h | 7 +-
>> include/linux/kexec.h | 4 ++
>> kernel/Makefile | 2 +-
>> kernel/crash_dump_dm_crypt.c | 121 +++++++++++++++++++++++++++++++++++
>> kernel/ksysfs.c | 23 ++++++-
>> 5 files changed, 153 insertions(+), 4 deletions(-)
>> create mode 100644 kernel/crash_dump_dm_crypt.c
>>
>>diff --git a/include/linux/crash_core.h b/include/linux/crash_core.h
>>index 5126a4fecb44..7078eda6418d 100644
>>--- a/include/linux/crash_core.h
>>+++ b/include/linux/crash_core.h
>>@@ -125,6 +125,12 @@ static inline void __init reserve_crashkernel_generic(char *cmdline,
>> {}
>> #endif
>>+struct kimage;
>>+
>>+int crash_sysfs_dm_crypt_key_write(const char *key_des, size_t count);
>>+int crash_pass_temp_dm_crypt_key(void **addr, unsigned long *sz);
>>+int crash_load_dm_crypt_key(struct kimage *image);
>>+
>> /* Alignment required for elf header segment */
>> #define ELF_CORE_HEADER_ALIGN 4096
>>@@ -140,7 +146,6 @@ extern int crash_exclude_mem_range(struct crash_mem *mem,
>> extern int crash_prepare_elf64_headers(struct crash_mem *mem, int need_kernel_map,
>> void **addr, unsigned long *sz);
>>-struct kimage;
>> struct kexec_segment;
>> #define KEXEC_CRASH_HP_NONE 0
>>diff --git a/include/linux/kexec.h b/include/linux/kexec.h
>>index 6f4626490ebf..bf7ab1e927ef 100644
>>--- a/include/linux/kexec.h
>>+++ b/include/linux/kexec.h
>>@@ -366,6 +366,10 @@ struct kimage {
>> void *elf_headers;
>> unsigned long elf_headers_sz;
>> unsigned long elf_load_addr;
>>+
>>+ /* dm crypt key buffer */
>>+ unsigned long dm_crypt_key_addr;
>>+ unsigned long dm_crypt_key_sz;
>> };
>> /* kexec interface functions */
>>diff --git a/kernel/Makefile b/kernel/Makefile
>>index 3947122d618b..48859bf63db5 100644
>>--- a/kernel/Makefile
>>+++ b/kernel/Makefile
>>@@ -119,7 +119,7 @@ obj-$(CONFIG_PERF_EVENTS) += events/
>> obj-$(CONFIG_USER_RETURN_NOTIFIER) += user-return-notifier.o
>> obj-$(CONFIG_PADATA) += padata.o
>>-obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
>>+obj-$(CONFIG_CRASH_DUMP) += crash_dump.o crash_dump_dm_crypt.o
>> obj-$(CONFIG_JUMP_LABEL) += jump_label.o
>> obj-$(CONFIG_CONTEXT_TRACKING) += context_tracking.o
>> obj-$(CONFIG_TORTURE_TEST) += torture.o
>>diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c
>>new file mode 100644
>>index 000000000000..3a0b0b773598
>>--- /dev/null
>>+++ b/kernel/crash_dump_dm_crypt.c
>>@@ -0,0 +1,121 @@
>>+// SPDX-License-Identifier: GPL-2.0-only
>>+#include <keys/user-type.h>
>>+#include <linux/crash_dump.h>
>>+
>>+static u8 *dm_crypt_key;
>>+static unsigned int dm_crypt_key_size;
>>+
>>+void wipe_dm_crypt_key(void)
>>+{
>>+ if (dm_crypt_key) {
>>+ memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
>>+ kfree(dm_crypt_key);
>>+ dm_crypt_key = NULL;
>>+ }
>>+}
>>+
>>+static void _wipe_dm_crypt_key(struct work_struct *dummy)
>>+{
>>+ wipe_dm_crypt_key();
>>+}
>>+
>>+static DECLARE_DELAYED_WORK(wipe_dm_crypt_key_work, _wipe_dm_crypt_key);
>>+
>>+static unsigned __read_mostly wipe_key_delay = 120; /* 2 mins */
>>+
>>+static int crash_save_temp_dm_crypt_key(const char *key_desc, size_t count)
>>+{
>>+ const struct user_key_payload *ukp;
>>+ struct key *key;
>>+
>>+ if (dm_crypt_key) {
>>+ memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
>>+ kfree(dm_crypt_key);
>>+ }
>>+
>>+ pr_debug("Requesting key %s", key_desc);
>>+ key = request_key(&key_type_user, key_desc, NULL);
>
>If we don't read the key copy form userspace (my reply to top level
>message) you could use key_type_logon here.
I'll use key_type_logon, thanks!
@@ -125,6 +125,12 @@ static inline void __init reserve_crashkernel_generic(char *cmdline,
{}
#endif
+struct kimage;
+
+int crash_sysfs_dm_crypt_key_write(const char *key_des, size_t count);
+int crash_pass_temp_dm_crypt_key(void **addr, unsigned long *sz);
+int crash_load_dm_crypt_key(struct kimage *image);
+
/* Alignment required for elf header segment */
#define ELF_CORE_HEADER_ALIGN 4096
@@ -140,7 +146,6 @@ extern int crash_exclude_mem_range(struct crash_mem *mem,
extern int crash_prepare_elf64_headers(struct crash_mem *mem, int need_kernel_map,
void **addr, unsigned long *sz);
-struct kimage;
struct kexec_segment;
#define KEXEC_CRASH_HP_NONE 0
@@ -366,6 +366,10 @@ struct kimage {
void *elf_headers;
unsigned long elf_headers_sz;
unsigned long elf_load_addr;
+
+ /* dm crypt key buffer */
+ unsigned long dm_crypt_key_addr;
+ unsigned long dm_crypt_key_sz;
};
/* kexec interface functions */
@@ -119,7 +119,7 @@ obj-$(CONFIG_PERF_EVENTS) += events/
obj-$(CONFIG_USER_RETURN_NOTIFIER) += user-return-notifier.o
obj-$(CONFIG_PADATA) += padata.o
-obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
+obj-$(CONFIG_CRASH_DUMP) += crash_dump.o crash_dump_dm_crypt.o
obj-$(CONFIG_JUMP_LABEL) += jump_label.o
obj-$(CONFIG_CONTEXT_TRACKING) += context_tracking.o
obj-$(CONFIG_TORTURE_TEST) += torture.o
new file mode 100644
@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <keys/user-type.h>
+#include <linux/crash_dump.h>
+
+static u8 *dm_crypt_key;
+static unsigned int dm_crypt_key_size;
+
+void wipe_dm_crypt_key(void)
+{
+ if (dm_crypt_key) {
+ memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
+ kfree(dm_crypt_key);
+ dm_crypt_key = NULL;
+ }
+}
+
+static void _wipe_dm_crypt_key(struct work_struct *dummy)
+{
+ wipe_dm_crypt_key();
+}
+
+static DECLARE_DELAYED_WORK(wipe_dm_crypt_key_work, _wipe_dm_crypt_key);
+
+static unsigned __read_mostly wipe_key_delay = 120; /* 2 mins */
+
+static int crash_save_temp_dm_crypt_key(const char *key_desc, size_t count)
+{
+ const struct user_key_payload *ukp;
+ struct key *key;
+
+ if (dm_crypt_key) {
+ memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
+ kfree(dm_crypt_key);
+ }
+
+ pr_debug("Requesting key %s", key_desc);
+ key = request_key(&key_type_user, key_desc, NULL);
+
+ if (IS_ERR(key)) {
+ pr_debug("No such key %s", key_desc);
+ return PTR_ERR(key);
+ }
+
+ ukp = user_key_payload_locked(key);
+ if (!ukp)
+ return -EKEYREVOKED;
+
+ dm_crypt_key = kmalloc(ukp->datalen, GFP_KERNEL);
+ if (!dm_crypt_key)
+ return -ENOMEM;
+ memcpy(dm_crypt_key, ukp->data, ukp->datalen);
+ dm_crypt_key_size = ukp->datalen;
+ pr_debug("dm crypt key (size=%u): %8ph\n", dm_crypt_key_size, dm_crypt_key);
+ schedule_delayed_work(&wipe_dm_crypt_key_work,
+ round_jiffies_relative(wipe_key_delay * HZ));
+ return 0;
+}
+
+int crash_sysfs_dm_crypt_key_write(const char *key_desc, size_t count)
+{
+ if (!is_kdump_kernel())
+ return crash_save_temp_dm_crypt_key(key_desc, count);
+ return -EINVAL;
+}
+EXPORT_SYMBOL(crash_sysfs_dm_crypt_key_write);
+
+int crash_pass_temp_dm_crypt_key(void **addr, unsigned long *sz)
+{
+ unsigned long dm_crypt_key_sz;
+ unsigned char *buf;
+ unsigned int *size_ptr;
+
+ if (!dm_crypt_key)
+ return -EINVAL;
+
+ dm_crypt_key_sz = sizeof(unsigned int) + dm_crypt_key_size * sizeof(u8);
+
+ buf = vzalloc(dm_crypt_key_sz);
+ if (!buf)
+ return -ENOMEM;
+
+ size_ptr = (unsigned int *)buf;
+ memcpy(size_ptr, &dm_crypt_key_size, sizeof(unsigned int));
+ memcpy(size_ptr + 1, dm_crypt_key, dm_crypt_key_size * sizeof(u8));
+ *addr = buf;
+ *sz = dm_crypt_key_sz;
+ wipe_dm_crypt_key();
+ return 0;
+}
+
+int crash_load_dm_crypt_key(struct kimage *image)
+{
+ int ret;
+ struct kexec_buf kbuf = {
+ .image = image,
+ .buf_min = 0,
+ .buf_max = ULONG_MAX,
+ .top_down = false,
+ .random = true,
+ };
+
+ image->dm_crypt_key_addr = 0;
+ ret = crash_pass_temp_dm_crypt_key(&kbuf.buffer, &kbuf.bufsz);
+ if (ret)
+ return ret;
+
+ kbuf.memsz = kbuf.bufsz;
+ kbuf.buf_align = ELF_CORE_HEADER_ALIGN;
+ kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
+ ret = kexec_add_buffer(&kbuf);
+ if (ret) {
+ vfree((void *)kbuf.buffer);
+ return ret;
+ }
+ image->dm_crypt_key_addr = kbuf.mem;
+ image->dm_crypt_key_sz = kbuf.bufsz;
+ pr_debug("Loaded dm crypt key at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
+ image->dm_crypt_key_addr, kbuf.bufsz, kbuf.bufsz);
+
+ return ret;
+}
@@ -165,16 +165,34 @@ static ssize_t vmcoreinfo_show(struct kobject *kobj,
}
KERNEL_ATTR_RO(vmcoreinfo);
+static ssize_t crash_dm_crypt_key_show(struct kobject *kobj,
+ struct kobj_attribute *attr,
+ char *buf)
+{
+ return 0;
+}
+
+static ssize_t crash_dm_crypt_key_store(struct kobject *kobj,
+ struct kobj_attribute *attr,
+ const char *buf, size_t count)
+{
+ int ret;
+
+ ret = crash_sysfs_dm_crypt_key_write(buf, count);
+ return ret < 0 ? ret : count;
+}
+KERNEL_ATTR_RW(crash_dm_crypt_key);
+
#ifdef CONFIG_CRASH_HOTPLUG
static ssize_t crash_elfcorehdr_size_show(struct kobject *kobj,
- struct kobj_attribute *attr, char *buf)
+ struct kobj_attribute *attr,
+ char *buf)
{
unsigned int sz = crash_get_elfcorehdr_size();
return sysfs_emit(buf, "%u\n", sz);
}
KERNEL_ATTR_RO(crash_elfcorehdr_size);
-
#endif
#endif /* CONFIG_CRASH_CORE */
@@ -267,6 +285,7 @@ static struct attribute * kernel_attrs[] = {
#endif
#ifdef CONFIG_CRASH_CORE
&vmcoreinfo_attr.attr,
+ &crash_dm_crypt_key_attr.attr,
#ifdef CONFIG_CRASH_HOTPLUG
&crash_elfcorehdr_size_attr.attr,
#endif