Hi liqiong, On 8/26/21 10:15 AM, liqiong wrote: > Hi Simon, > > Thanks for your help, your advice is clear, can i just use it, > how about this: > > > The current IMA ruleset is identified by the variable "ima_rules", > and the pointer starts pointing at the list "ima_default_rules". After reading it again, maybe "The current IMA ruleset is identified by the variable "ima_rules", that defaults to "&ima_default_rules".'? > When loading a custom policy for the first time, the variable is > updated to point to the list "ima_policy_rules" instead. That update > isn't RCU-safe, and deadlocks are possible. I think what Mimi was trying to say is that you could add the high-level overview above, but keep the details. Sorry if I wasn't clearer in my earlier messages. Consider re-adding your previous paragraph """ As a consequence, when traversing the ruleset, some functions like ima_match_policy() may loop indefinitely over "ima_default_rules" as list_for_each_entry_rcu() doesn't terminate (after the update, "ima_rules" no longer points to the list head, so the loop condition stays always true), causing RCU stalls. """ (note: I tweaked it above, feel free to fix it) > > Introduce a temporary value for "ima_rules" when iterating over > the ruleset to avoid the deadlocks. ... while keeping this a separate paragraph. > > > Signed-off-by: liqiong <liqiong@xxxxxxxxxxxx> > --- > security/integrity/ima/ima_policy.c | 17 ++++++++++++----- > 1 file changed, 12 insertions(+), 5 deletions(-) > > diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c > index fd5d46e511f1..e92b197bfd3c 100644 > --- a/security/integrity/ima/ima_policy.c > +++ b/security/integrity/ima/ima_policy.c > > > > Thanks > > liqiong
