On Wed, Jan 04, 2023 at 12:23:44AM +0000, Eric Biggers wrote: > I'm also surprised that this wasn't found earlier. Is it possible that CFI does > not actually distinguish between the two function prototypes here? > It's because this code is only reached when ext4 is a loadable module and it is being unloaded. I can reproduce the CFI failure by doing that. In addition to the naming tweak I requested, can you also add Fixes and Cc stable tags? By the way, here's the log from the CFI failure I got: [ 16.412498] CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698) [ 16.413716] invalid opcode: 0000 [#1] PREEMPT SMP [ 16.414299] CPU: 2 PID: 179 Comm: rmmod Tainted: G T 6.2.0-rc2 #28 [ 16.415223] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.1-1-1 04/01/2014 [ 16.416383] RIP: 0010:kobject_put+0xbb/0x1b0 [ 16.416926] Code: df e8 f9 03 00 00 4d 85 e4 74 24 49 83 3c 24 00 74 1d 0f 1f 44 00 00 48 89 df 4d 8b 1c 24 41 ba 68 59 b5 9 [ 16.419199] RSP: 0018:ffffc90000283e20 EFLAGS: 00010a13 [ 16.419842] RAX: 0000000000000000 RBX: ffff88800436c9c0 RCX: 0000000000000000 [ 16.420719] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88800436c9c0 [ 16.421595] RBP: ffffc90000283e40 R08: 0000000000000000 R09: 0000000000000000 [ 16.422465] R10: 0000000017461662 R11: ffffffff81216a20 R12: ffffffffa00f9510 [ 16.423330] R13: 0000000000000000 R14: ffff88800436ca80 R15: ffff888007643950 [ 16.424207] FS: 00007f7bf573f740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [ 16.425188] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 16.425814] CR2: 0000561eb661f818 CR3: 00000000074c9000 CR4: 00000000003506e0 [ 16.426574] Call Trace: [ 16.426862] <TASK> [ 16.427098] ext4_exit_sysfs+0x14/0x60 [ext4] [ 16.427604] cleanup_module+0x67/0xedb [ext4] [ 16.428099] __se_sys_delete_module+0x22d/0x3e0 [ 16.428593] ? syscall_enter_from_user_mode+0x2a/0x1d0 [ 16.429142] ? syscall_enter_from_user_mode+0x2a/0x1d0 [ 16.429694] __x64_sys_delete_module+0x11/0x20 [ 16.430173] do_syscall_64+0x53/0xb0 [ 16.430562] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 16.431151] RIP: 0033:0x7f7bf584ccfb [ 16.431544] Code: 73 01 c3 48 8b 0d 8d f0 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 8 [ 16.433517] RSP: 002b:00007fff7d959068 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 16.434327] RAX: ffffffffffffffda RBX: 0000561eb6615750 RCX: 00007f7bf584ccfb [ 16.435090] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000561eb66157b8 [ 16.435852] RBP: 0000000000000000 R08: 1999999999999999 R09: 0000000000000000 [ 16.436617] R10: 00007f7bf58c2ac0 R11: 0000000000000206 R12: 0000000000000000 [ 16.437472] R13: 00007fff7d9592d0 R14: 00007fff7d959d80 R15: 0000561eb66152a0 [ 16.438307] </TASK> [ 16.438552] Modules linked in: ext4(-) crc32c_generic mbcache crc16 jbd2 [ 16.439321] ---[ end trace 0000000000000000 ]--- [ 16.439829] RIP: 0010:kobject_put+0xbb/0x1b0 [ 16.440294] Code: df e8 f9 03 00 00 4d 85 e4 74 24 49 83 3c 24 00 74 1d 0f 1f 44 00 00 48 89 df 4d 8b 1c 24 41 ba 68 59 b5 9 [ 16.442310] RSP: 0018:ffffc90000283e20 EFLAGS: 00010a13 [ 16.442960] RAX: 0000000000000000 RBX: ffff88800436c9c0 RCX: 0000000000000000 [ 16.443719] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88800436c9c0 [ 16.444472] RBP: ffffc90000283e40 R08: 0000000000000000 R09: 0000000000000000 [ 16.445231] R10: 0000000017461662 R11: ffffffff81216a20 R12: ffffffffa00f9510 [ 16.446012] R13: 0000000000000000 R14: ffff88800436ca80 R15: ffff888007643950 [ 16.446779] FS: 00007f7bf573f740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [ 16.447658] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 16.448276] CR2: 0000561eb661f818 CR3: 00000000074c9000 CR4: 00000000003506e0
