Re: [GIT PULL] Security subsystem updates for 4.14

[Christoph Hellwig]

The reason why I send out the original version of this patch
is because IMA used to call ->read under i_rwsem, and that deadlocked
on XFS and NFS, or ext3/4 with DAX.  The call path for that is

process_measurement (takes i_rwsem)
  -> ima_collect_measurement
    -> ima_calc_file_hash
       -> ima_calc_file_ahash / ima_calc_file_shash
         -> ima_calc_file_hash_atfm / ima_calc_file_hash_tfm
	   -> integrity_kernel_read

ima_check_last_writer (takes i_rwsem)
  -> ima_update_xattr
    -> ima_collect_measurement
       -> (as above)

But yes, for the init-time integrity_read_file this is incorrect.
It never tripped up, and I explicitly added the lockdep annotations
so that anything would show up, and it's been half a year since
I sent that first RFC patch..