No upstream commit exists for this patch.
The bug was fixed by upstream commit cdb46a8aefbf ("efivarfs: Move
efivarfs list into superblock s_fs_info") but it depends on major changes
done in the mainline kernel and 5.10.y needs its own patch.
Add locking around efivarfs_list operations to prevent race conditions
during processing of multiple filesystem superblock instances.
list_del corruption. prev->next should be ffff0000d86d6828, but was ffff800016216e60. (prev=ffff800016216e60)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4299 Comm: syz-executor237 Not tainted 6.1.119-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
lr : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
Call trace:
__list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
__list_del_entry include/linux/list.h:134 [inline]
list_del include/linux/list.h:148 [inline]
efivar_entry_remove+0x38/0x110 fs/efivarfs/vars.c:493
efivarfs_destroy+0x20/0x3c fs/efivarfs/super.c:184
efivar_entry_iter+0x94/0xdc fs/efivarfs/vars.c:720
efivarfs_kill_sb+0x58/0x70 fs/efivarfs/super.c:258
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
Reported-by: syzbot+246ea4feed277471958a@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=246ea4feed277471958a
Fixes: e14ab23dde12 ("efivars: efivar_entry API")
Signed-off-by: Alexey Nepomnyashih <sdl@xxxxxxxx>
---
drivers/firmware/efi/vars.c | 11 +++++++----
fs/efivarfs/super.c | 4 ++++
2 files changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 010febd2ab6b..517bf886ba14 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -417,6 +417,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
const struct efivar_operations *ops;
unsigned long variable_name_size = 512;
efi_char16_t *variable_name;
+ bool var_present = false;
efi_status_t status;
efi_guid_t vendor_guid;
int err = 0;
@@ -451,8 +452,12 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
&vendor_guid);
switch (status) {
case EFI_SUCCESS:
- if (duplicates)
+ if (duplicates) {
+ var_present = variable_is_present(variable_name,
+ &vendor_guid,
+ head);
up(&efivars_lock);
+ }
variable_name_size = var_name_strnsize(variable_name,
variable_name_size);
@@ -465,9 +470,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
* we'll ever see a different variable name,
* and may end up looping here forever.
*/
- if (duplicates &&
- variable_is_present(variable_name, &vendor_guid,
- head)) {
+ if (duplicates && var_present) {
dup_variable_bug(variable_name, &vendor_guid,
variable_name_size);
status = EFI_NOT_FOUND;
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 24a0c5ef4169..7a6e2676b312 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -212,7 +212,11 @@ static int efivarfs_fill_super(struct super_block *sb, struct fs_context *fc)
if (!root)
return -ENOMEM;
+ err = efivar_entry_iter_begin();
+ if (err)
+ return err;
INIT_LIST_HEAD(&efivarfs_list);
+ efivar_entry_iter_end();
err = efivar_init(efivarfs_callback, (void *)sb, true, &efivarfs_list);
if (err)
--
2.43.0
