lkml.org 
[lkml]   [2021]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] ima: fix deadlock within "ima_match_policy" function.
From
Date
On Tue, 2021-08-24 at 20:09 +0800, liqiong wrote:
> Hi Simon :
>
> ima: fix deadlock within RCU list of ima_rules.
>

Before the following paragraph, an introductory sentence is needed.
Try adding a sentence to the affect that "ima_rules" initially points
to the "ima_default_rules", but after loading a custom policy points to
the "ima_policy_rules". Then describe the bug at a high level,
something like - transitioning to the "ima_policy_rules" isn't being
done safely.

Followed by the details.

> ima_match_policy() is looping on the policy ruleset while
> ima_update_policy() updates the variable "ima_rules". This can
> lead to a situation where ima_match_policy() can't exit the
> 'list_for_each_entry_rcu' loop, causing RCU stalls
> ("rcu_sched detected stall on CPU ...").
>
> This problem can happen in practice: updating the IMA policy
> in the boot process while systemd-services are being checked.
>
> In addition to ima_match_policy(), other function with
> "list_for_each_entry_rcu" should happen too. Fix locking by
> introducing a duplicate of "ima_rules" for each
> "list_for_each_entry_rcu".
>
>
> How about this commit message ?
>
> I have tested this patch in lab, we can reproduced this error case,
> have done reboot test many times. This patch should work.

The above comment doesn't belong in the commit message, but is a
message to the reviewers/maintainers and goes after the patch
descriptions three dashes line.

thanks,

Mimi

\
 
 \ /
  Last update: 2021-08-24 14:39    [W:0.128 / U:0.412 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site