From: Roberto Sassu <roberto.sassu@xxxxxxxxxx> Invoking digest_cache_get() inside the iint->mutex critical region can cause deadlocks due to the fact that IMA can be recursively invoked for reading the digest list. The deadlock would occur if the Integrity Digest Cache attempts to read the same inode that is already locked by IMA. However, since the Integrity Digest Cache makes sure that the above situation never happens, as it checks the inodes, it is safe to call digest_cache_get() inside the critical region and nest the iint->mutex when the DIGEST_LIST_CHECK hook is executed. Change the mutex_lock() call for the iint mutex into mutex_lock_nested(), and add a subclass that is 0 if the IMA hook executed is not DIGEST_LIST_CHECK, and 1 if it is. Specifying the subclass does not interfere with the class annotation in ima_iint_lockdep_annotate(), to make IMA work with overlayfs. Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx> --- security/integrity/ima/ima_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index cff8b5a12512..06ee99bd7886 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -266,7 +266,7 @@ static int process_measurement(struct file *file, const struct cred *cred, if (!action) goto out; - mutex_lock(&iint->mutex); + mutex_lock_nested(&iint->mutex, func == DIGEST_LIST_CHECK); if (test_and_clear_bit(IMA_CHANGE_ATTR, &iint->atomic_flags)) /* reset appraisal flags if ima_inode_post_setattr was called */ -- 2.34.1
