From: THOBY Simon <Simon.THOBY@viveris.fr>
To: liqiong <liqiong@nfschina.com>, Mimi Zohar <zohar@linux.ibm.com>
Cc: "dmitry.kasatkin@gmail.com" <dmitry.kasatkin@gmail.com>,
"jmorris@namei.org" <jmorris@namei.org>,
"serge@hallyn.com" <serge@hallyn.com>,
"linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] ima: fix deadlock within RCU list of ima_rules
Date: Thu, 26 Aug 2021 09:01:04 +0000 [thread overview]
Message-ID: <3ef6906b-ccf1-0ab8-180b-b71568e22443@viveris.fr> (raw)
In-Reply-To: <1e464ae0-28e1-6511-ab89-52b5cd1a0841@nfschina.com>
Hi liqiong,
On 8/26/21 10:15 AM, liqiong wrote:
> Hi Simon,
>
> Thanks for your help, your advice is clear, can i just use it,
> how about this:
>
>
> The current IMA ruleset is identified by the variable "ima_rules",
> and the pointer starts pointing at the list "ima_default_rules".
After reading it again, maybe
"The current IMA ruleset is identified by the variable "ima_rules",
that defaults to "&ima_default_rules".'?
> When loading a custom policy for the first time, the variable is
> updated to point to the list "ima_policy_rules" instead. That update
> isn't RCU-safe, and deadlocks are possible.
I think what Mimi was trying to say is that you could add the high-level
overview above, but keep the details. Sorry if I wasn't clearer in my
earlier messages.
Consider re-adding your previous paragraph
"""
As a consequence, when traversing the ruleset, some functions like ima_match_policy()
may loop indefinitely over "ima_default_rules" as list_for_each_entry_rcu() doesn't
terminate (after the update, "ima_rules" no longer points to the list head, so the
loop condition stays always true), causing RCU stalls.
"""
(note: I tweaked it above, feel free to fix it)
>
> Introduce a temporary value for "ima_rules" when iterating over
> the ruleset to avoid the deadlocks.
... while keeping this a separate paragraph.
>
>
> Signed-off-by: liqiong <liqiong@nfschina.com>
> ---
> security/integrity/ima/ima_policy.c | 17 ++++++++++++-----
> 1 file changed, 12 insertions(+), 5 deletions(-)
>
> diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
> index fd5d46e511f1..e92b197bfd3c 100644
> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c
>
>
>
> Thanks
>
> liqiong
next prev parent reply other threads:[~2021-08-26 9:01 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-19 10:15 [PATCH] ima: fix infinite loop within "ima_match_policy" function liqiong
2021-08-19 12:58 ` THOBY Simon
2021-08-19 13:47 ` Mimi Zohar
2021-08-19 19:31 ` Mimi Zohar
2021-08-20 10:15 ` 李力琼
2021-08-20 13:23 ` THOBY Simon
2021-08-20 15:48 ` Mimi Zohar
2021-08-23 3:04 ` 李力琼
2021-08-23 7:51 ` 李力琼
2021-08-23 8:06 ` liqiong
2021-08-23 8:14 ` THOBY Simon
2021-08-23 11:57 ` Mimi Zohar
2021-08-23 12:02 ` THOBY Simon
2021-08-23 12:09 ` Mimi Zohar
2021-08-23 12:56 ` liqiong
2021-08-23 11:22 ` Mimi Zohar
2021-08-20 17:53 ` liqiong
2021-08-23 7:13 ` THOBY Simon
2021-08-24 8:57 ` [PATCH] ima: fix deadlock " liqiong
2021-08-24 9:50 ` THOBY Simon
2021-08-24 12:09 ` liqiong
2021-08-24 12:38 ` Mimi Zohar
2021-08-25 7:05 ` [PATCH] ima: fix deadlock within RCU list of ima_rules liqiong
2021-08-25 11:45 ` liqiong
2021-08-25 12:03 ` THOBY Simon
2021-08-26 8:15 ` liqiong
2021-08-26 9:01 ` THOBY Simon [this message]
2021-08-27 6:41 ` liqiong
2021-08-27 7:30 ` THOBY Simon
2021-08-27 9:10 ` liqiong
2021-08-27 9:20 ` THOBY Simon
2021-08-27 10:35 ` [PATCH] ima: fix deadlock when traversing "ima_default_rules" liqiong
2021-08-27 16:16 ` Mimi Zohar
2021-09-18 3:11 ` liqiong
2021-09-30 19:46 ` Mimi Zohar
2021-10-09 10:38 ` liqiong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3ef6906b-ccf1-0ab8-180b-b71568e22443@viveris.fr \
--to=simon.thoby@viveris.fr \
--cc=dmitry.kasatkin@gmail.com \
--cc=jmorris@namei.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=liqiong@nfschina.com \
--cc=serge@hallyn.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.