linux-kernel - RE: Oops (probably) unmounting /oldroot/firmware/efi/efivars.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4bd4f6ca36334473bc55bf3b5704afa1@AcuMS.aculab.com>
Date:   Tue, 24 Nov 2020 15:30:42 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Ard Biesheuvel' <ardb@...nel.org>
CC:     linux-efi <linux-efi@...r.kernel.org>,
        kernel list <linux-kernel@...r.kernel.org>,
        "matthew.garrett@...ula.com" <matthew.garrett@...ula.com>,
        "jk@...abs.org" <jk@...abs.org>
Subject: RE: Oops (probably) unmounting /oldroot/firmware/efi/efivars.

From: Ard Biesheuvel
> Sent: 24 November 2020 15:02
> On Tue, 24 Nov 2020 at 15:58, David Laight <David.Laight@...lab.com> wrote:
> >
> > From: Ard Biesheuvel
> > > Sent: 24 November 2020 14:24
> > >
> > > On Tue, 24 Nov 2020 at 15:22, David Laight <David.Laight@...lab.com> wrote:
> > > >
> > > > I've just updated to the head of Linus's tree (5.10-rc5) and got the following
> > > > 'splat' during shutdown.
> > > >
> > > > Userspace is Ubuntu 20.04.
> > > >
> > > > rc4 rebooted fine.
> > > >
> > > > I'll try to bisect - but it isn't quick.
> > > >
> > >
> > > Surely caused by
> > >
> > >
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/efivarfs?id=fe5186cf12e30
> > > facfe261e9be6c7904a170bd822
> >
> > Yep, reboots fine with that kfree() commented out.
> >
> 
> Thanks for confirming.
> 
> Does it also work when keeping the kfree() and setting
> inode->i_private to NULL explicitly afterwards?

No, that still panics.
Setting i_private NULL (but without the kfree()) is ok.

I'm seeing 42 calls with a non-NULL i_private.
The final call has i_private NULL and isn't a duplicate.

There must be another pointer into one of the structures.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)