Messages in this thread | | | From | THOBY Simon <> | Subject | Re: [PATCH] ima: fix deadlock within RCU list of ima_rules | Date | Thu, 26 Aug 2021 09:01:04 +0000 |
| |
Hi liqiong,
On 8/26/21 10:15 AM, liqiong wrote: > Hi Simon, > > Thanks for your help, your advice is clear, can i just use it, > how about this: > > > The current IMA ruleset is identified by the variable "ima_rules", > and the pointer starts pointing at the list "ima_default_rules".
After reading it again, maybe "The current IMA ruleset is identified by the variable "ima_rules", that defaults to "&ima_default_rules".'?
> When loading a custom policy for the first time, the variable is > updated to point to the list "ima_policy_rules" instead. That update > isn't RCU-safe, and deadlocks are possible.
I think what Mimi was trying to say is that you could add the high-level overview above, but keep the details. Sorry if I wasn't clearer in my earlier messages.
Consider re-adding your previous paragraph """ As a consequence, when traversing the ruleset, some functions like ima_match_policy() may loop indefinitely over "ima_default_rules" as list_for_each_entry_rcu() doesn't terminate (after the update, "ima_rules" no longer points to the list head, so the loop condition stays always true), causing RCU stalls. """ (note: I tweaked it above, feel free to fix it) > > Introduce a temporary value for "ima_rules" when iterating over > the ruleset to avoid the deadlocks.
... while keeping this a separate paragraph.
> > > Signed-off-by: liqiong <liqiong@nfschina.com> > --- > security/integrity/ima/ima_policy.c | 17 ++++++++++++----- > 1 file changed, 12 insertions(+), 5 deletions(-) > > diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c > index fd5d46e511f1..e92b197bfd3c 100644 > --- a/security/integrity/ima/ima_policy.c > +++ b/security/integrity/ima/ima_policy.c > > > > Thanks > > liqiong | |