On Fri, 2021-08-27 at 18:35 +0800, liqiong wrote: > The current IMA ruleset is identified by the variable "ima_rules" > that default to "&ima_default_rules". When loading a custom policy > for the first time, the variable is updated to "&ima_policy_rules" > instead. That update isn't RCU-safe, and deadlocks are possible. > Indeed, some functions like ima_match_policy() may loop indefinitely > when traversing "ima_default_rules" with list_for_each_entry_rcu(). > > When iterating over the default ruleset back to head, if the list > head is "ima_default_rules", and "ima_rules" have been updated to > "&ima_policy_rules", the loop condition (&entry->list != ima_rules) > stays always true, traversing won't terminate, causing a soft lockup > and RCU stalls. > > Introduce a temporary value for "ima_rules" when iterating over > the ruleset to avoid the deadlocks. > > Signed-off-by: liqiong <liqiong@xxxxxxxxxxxx> > Reviewed-by: THOBY Simon <Simon.THOBY@xxxxxxxxxx> Thank you, Liqiong, Simon. This patch set is now queued in the next- integrity-testing branch. Mimi
