Re: [PATCH] ima: hold ima_extend_list_mutex while locating the trim position

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] ima: comment and commit message in ima_queue_delete_partial() cite non-existent ima_extend_list()
--

commit 1fb4a03b7cbb60d3d99dc9d31af10d612ce10f6a
Author: Weibin Liu <liuwb@xiaopeng.com>

ima: hold ima_extend_list_mutex while locating the trim position

This commit moves the measurement list lookup in ima_queue_delete_partial()
under ima_extend_list_mutex so that locating the trim position and cutting the
list are serialized against concurrent writers on separate file descriptors.

> diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
> index 0f1b7e4113c4f..cf8c164eea139 100644
> --- a/security/integrity/ima/ima_queue.c
> +++ b/security/integrity/ima/ima_queue.c
> @@ -427,12 +427,16 @@ int ima_queue_delete_partial(unsigned long req_value)
>  	struct ima_queue_entry *qe;
>  	int ret = 0;
>  
> +	mutex_lock(&ima_extend_list_mutex);
> +
>  	/*
> -	 * list_for_each_entry_rcu() without rcu_read_lock() is fine because
> -	 * only list append can happen concurrently. No list replace due to the
> -	 * staging/delete writers mutual exclusion.
> +	 * The lookup and the cut have to be atomic with respect to other
> +	 * writers: ima_fs.c serializes open(), but write() can run
> +	 * concurrently on independently opened descriptors. Holding
> +	 * ima_extend_list_mutex also excludes ima_extend_list(), so the
> +	 * plain list traversal is sufficient.
>  	 */

[Severity: Low]
This isn't a bug, but both the comment in ima_queue_delete_partial() and the
commit message refer to ima_extend_list(), which does not exist in the tree.

Entries are appended to ima_measurements in ima_add_digest_entry() (called
from ima_add_template_entry() and ima_restore_measurement_entry()) while
holding ima_extend_list_mutex. Should the comment and commit message refer to
ima_add_digest_entry() instead of ima_extend_list()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104053705.3967228-1-liuwb@xiaopeng.com?part=1