Re: [PATCH] ima: fix infinite loop within "ima_match_policy" function.

Mimi Zohar
2021-08-23T11:23:14Z

Hi Liqiong,

On Mon, 2021-08-23 at 11:04 +0800, 李力琼 wrote:
> Hi Mimi :
>
> The situation is a little different,'list_splice_init_rcu'
> don't change the list head. If "ima_rules" being changed,
> readers may can't reload the new value in time for cpu cache
> or compiler optimization. Defining "ima_rules" as a volatile
> variable can fix, but It is inefficient.

After looking at list_splice_tail_init_rcu() some more, it is
actually making sure there aren't any readers traversing
"ima_temp_rules", not "ima_policy_rules". There aren't any readers
traversing "ima_temp_rules".

>
> Maybe using a temporary ima_rules variable for every
> "list_for_each_entry_rcu(entry, ima_rules, list)" loop is
> a better solution to fix the "endless loop" bug.

Agreed

thanks,

Mimi