[3/3] ima: Mark concurrent accesses to the iint pointer in the inode security blob

Commit Message

Roberto Sassu Oct. 8, 2024, 4:57 p.m. UTC

From: Roberto Sassu <[e-mail]>

Use the READ_ONCE() and WRITE_ONCE() macros to mark concurrent read and
write accesses to the portion of the inode security blob containing the
iint pointer.

Writers are serialized by the iint lock.

Signed-off-by: Roberto Sassu <[e-mail]>
---
 security/integrity/ima/ima.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Patch

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 6474a15b584a..3fe1651395ce 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -215,7 +215,7 @@  ima_inode_get_iint(const struct inode *inode)
 		return NULL;
 
 	iint_lock = ima_inode_security(inode->i_security);
-	return iint_lock->iint;
+	return READ_ONCE(iint_lock->iint);
 }
 
 static inline void ima_inode_set_iint(const struct inode *inode,
@@ -227,7 +227,7 @@  static inline void ima_inode_set_iint(const struct inode *inode,
 		return;
 
 	iint_lock = ima_inode_security(inode->i_security);
-	iint_lock->iint = iint;
+	WRITE_ONCE(iint_lock->iint, iint);
 }
 
 struct ima_iint_cache *ima_iint_find(struct inode *inode);