From: Mimi Zohar <zohar@linux.ibm.com>
To: THOBY Simon <Simon.THOBY@viveris.fr>, liqiong <liqiong@nfschina.com>
Cc: "dmitry.kasatkin@gmail.com" <dmitry.kasatkin@gmail.com>,
"jmorris@namei.org" <jmorris@namei.org>,
"serge@hallyn.com" <serge@hallyn.com>,
"linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] ima: fix infinite loop within "ima_match_policy" function.
Date: Thu, 19 Aug 2021 09:47:20 -0400 [thread overview]
Message-ID: <ed27351e0574f58ee59a3024554b8b0c7293515f.camel@linux.ibm.com> (raw)
In-Reply-To: <8d17f252-4a93-f430-3f25-e75556ab01e8@viveris.fr>
On Thu, 2021-08-19 at 12:58 +0000, THOBY Simon wrote:
> Hi Liqiong,
>
> On 8/19/21 12:15 PM, liqiong wrote:
> > When "ima_match_policy" is looping while "ima_update_policy" changs
> > the variable "ima_rules", then "ima_match_policy" may can't exit loop,
> > and kernel keeps printf "rcu_sched detected stall on CPU ...".
> >
> > It occurs at boot phase, systemd-services are being checked within
> > "ima_match_policy,at the same time, the variable "ima_rules"
> > is changed by a service.
>
> First off, thanks for finding and identifying this nasty bug.
Once the initial builtin policy rules have been replaced by a custom
policy, rules may only be appended by splicing the new rules with the
existing rules. There should never be a problem reading the rules at
that point. Does this problem occur before the builtin policy rules
have been replaced with a custom policy?
Mimi
next prev parent reply other threads:[~2021-08-19 13:47 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-19 10:15 [PATCH] ima: fix infinite loop within "ima_match_policy" function liqiong
2021-08-19 12:58 ` THOBY Simon
2021-08-19 13:47 ` Mimi Zohar [this message]
2021-08-19 19:31 ` Mimi Zohar
2021-08-20 10:15 ` 李力琼
2021-08-20 13:23 ` THOBY Simon
2021-08-20 15:48 ` Mimi Zohar
2021-08-23 3:04 ` 李力琼
2021-08-23 7:51 ` 李力琼
2021-08-23 8:06 ` liqiong
2021-08-23 8:14 ` THOBY Simon
2021-08-23 11:57 ` Mimi Zohar
2021-08-23 12:02 ` THOBY Simon
2021-08-23 12:09 ` Mimi Zohar
2021-08-23 12:56 ` liqiong
2021-08-23 11:22 ` Mimi Zohar
2021-08-20 17:53 ` liqiong
2021-08-23 7:13 ` THOBY Simon
2021-08-24 8:57 ` [PATCH] ima: fix deadlock " liqiong
2021-08-24 9:50 ` THOBY Simon
2021-08-24 12:09 ` liqiong
2021-08-24 12:38 ` Mimi Zohar
2021-08-25 7:05 ` [PATCH] ima: fix deadlock within RCU list of ima_rules liqiong
2021-08-25 11:45 ` liqiong
2021-08-25 12:03 ` THOBY Simon
2021-08-26 8:15 ` liqiong
2021-08-26 9:01 ` THOBY Simon
2021-08-27 6:41 ` liqiong
2021-08-27 7:30 ` THOBY Simon
2021-08-27 9:10 ` liqiong
2021-08-27 9:20 ` THOBY Simon
2021-08-27 10:35 ` [PATCH] ima: fix deadlock when traversing "ima_default_rules" liqiong
2021-08-27 16:16 ` Mimi Zohar
2021-09-18 3:11 ` liqiong
2021-09-30 19:46 ` Mimi Zohar
2021-10-09 10:38 ` liqiong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ed27351e0574f58ee59a3024554b8b0c7293515f.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=Simon.THOBY@viveris.fr \
--cc=dmitry.kasatkin@gmail.com \
--cc=jmorris@namei.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=liqiong@nfschina.com \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).