[PATCH] ima: fix infinite loop within "ima_match_policy" function.
Mimi Zohar
zohar at linux.ibm.com
Mon Aug 23 11:22:52 UTC 2021
Hi Liqiong,
On Mon, 2021-08-23 at 11:04 +0800, 李力琼 wrote:
> Hi Mimi :
>
> The situation is a little different,'list_splice_init_rcu'
> don't change the list head. If "ima_rules" being changed,
> readers may can't reload the new value in time for cpu cache
> or compiler optimization. Defining "ima_rules" as a volatile
> variable can fix, but It is inefficient.
After looking at list_splice_tail_init_rcu() some more, it is
actually making sure there aren't any readers traversing
"ima_temp_rules", not "ima_policy_rules". There aren't any readers
traversing "ima_temp_rules".
>
> Maybe using a temporary ima_rules variable for every
> "list_for_each_entry_rcu(entry, ima_rules, list)" loop is
> a better solution to fix the "endless loop" bug.
Agreed
thanks,
Mimi
More information about the Linux-security-module-archive
mailing list