ima: fix deadlock when traversing "ima_default_rules".

mainline inclusion
from mainline-v5.16-rc1
commit eb0782bb
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9AAM6
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eb0782bbdfd0d7c4786216659277c3fd585afc0e



--------------------------------

The current IMA ruleset is identified by the variable "ima_rules"
that default to "&ima_default_rules". When loading a custom policy
for the first time, the variable is updated to "&ima_policy_rules"
instead. That update isn't RCU-safe, and deadlocks are possible.
Indeed, some functions like ima_match_policy() may loop indefinitely
when traversing "ima_default_rules" with list_for_each_entry_rcu().

When iterating over the default ruleset back to head, if the list
head is "ima_default_rules", and "ima_rules" have been updated to
"&ima_policy_rules", the loop condition (&entry->list != ima_rules)
stays always true, traversing won't terminate, causing a soft lockup
and RCU stalls.

Introduce a temporary value for "ima_rules" when iterating over
the ruleset to avoid the deadlocks.

Signed-off-by: liqiong <liqiong@nfschina.com>
Reviewed-by: THOBY Simon <Simon.THOBY@viveris.fr>
Fixes: 38d859f9 ("IMA: policy can now be updated multiple times")
Reported-by: kernel test robot <lkp@intel.com> (Fix sparse: incompatible types in comparison expression.)
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Conflicts:
	security/integrity/ima/ima_policy.c
[Context conflicts. Besides an additional pair of rcu_read_lock and
unlock has been added to ima_update_policy_flag to mitigate a suspicious
RCU usage warning. This pair of RCU lock was added with commit
4f2946aa ("IMA: introduce a new policy option func=SETXATTR_CHECK")
on mainstream.]
Signed-off-by: GUO Zihua <guozihua@huawei.com>