On Tue, 2026-07-14 at 17:17 +0800, Gaosheng Cui wrote:
> When hashing large files, the while loop in ima_calc_file_hash_tfm
> processes PAGE_SIZE chunks without any scheduling point, which can
> cause soft lockup warnings:
> watchdog: BUG: soft lockup - CPU#0 stuck for 50s!
> Call Trace:
> _sha256_update+0x12d/0x1a0
> ima_calc_file_hash_tfm+0xfb/0x150
> ima_calc_file_hash+0x6e/0x160
> ima_collect_measurement+0x202/0x340
> process_measurement+0x3a9/0xb30
> ima_file_check+0x56/0xa0
> do_open+0x11b/0x250
> path_openat+0x10b/0x1d0
> do_filp_open+0xa9/0x150
> do_sys_openat2+0x223/0x2a0
> __x64_sys_openat+0x54/0xa0
> do_syscall_64+0x59/0x110
> entry_SYSCALL_64_after_hwframe+0x78/0xe2
>
> Call cond_resched() every 4MB to yield the CPU when needed, rather
> than at every loop iteration, to reduce overhead.
>
> Fixes: 3323eec921ef ("integrity: IMA as an integrity service provider")
> Signed-off-by: Gaosheng Cui <[email protected]>
Reviewed-by: Roberto Sassu <[email protected]>
Thanks
Roberto
> ---
> v2: call cond_resched() every 4MB to yield the CPU when needed
> security/integrity/ima/ima_crypto.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/security/integrity/ima/ima_crypto.c
> b/security/integrity/ima/ima_crypto.c
> index 0d72b48249ee..aab2349c0c33 100644
> --- a/security/integrity/ima/ima_crypto.c
> +++ b/security/integrity/ima/ima_crypto.c
> @@ -233,6 +233,9 @@ static int ima_calc_file_hash_tfm(struct file *file,
> rc = crypto_shash_update(shash, rbuf, rbuf_len);
> if (rc)
> break;
> +
> + if (IS_ALIGNED(offset, SZ_4M))
> + cond_resched();
> }
> kfree(rbuf);
> out:
