linux-kernel - [PATCH 5.10 2/2] efivarfs: Add efivars_lock to synchronize list operations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250321182126.1716111-2-sdl@nppct.ru>
Date: Fri, 21 Mar 2025 18:21:25 +0000
From: Alexey Nepomnyashih <sdl@...ct.ru>
To: Ard Biesheuvel <ardb@...nel.org>
Cc: Alexey Nepomnyashih <sdl@...ct.ru>,
	Jeremy Kerr <jk@...abs.org>,
	linux-efi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org,
	syzbot+246ea4feed277471958a@...kaller.appspotmail.com
Subject: [PATCH 5.10 2/2] efivarfs: Add efivars_lock to synchronize list operations

No upstream commit exists for this patch.
    
The bug was fixed by upstream commit cdb46a8aefbf ("efivarfs: Move
efivarfs list into superblock s_fs_info") but it depends on major changes
done in the mainline kernel and 5.10.y needs its own patch.

Add locking around efivarfs_list operations to prevent race conditions
during processing of multiple filesystem superblock instances.

list_del corruption. prev->next should be ffff0000d86d6828, but was ffff800016216e60. (prev=ffff800016216e60)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4299 Comm: syz-executor237 Not tainted 6.1.119-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
lr : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
Call trace:
__list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
__list_del_entry include/linux/list.h:134 [inline]
list_del include/linux/list.h:148 [inline]
efivar_entry_remove+0x38/0x110 fs/efivarfs/vars.c:493
efivarfs_destroy+0x20/0x3c fs/efivarfs/super.c:184
efivar_entry_iter+0x94/0xdc fs/efivarfs/vars.c:720
efivarfs_kill_sb+0x58/0x70 fs/efivarfs/super.c:258
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193

Reported-by: syzbot+246ea4feed277471958a@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=246ea4feed277471958a
Fixes: e14ab23dde12 ("efivars: efivar_entry API")
Signed-off-by: Alexey Nepomnyashih <sdl@...ct.ru>
---
 drivers/firmware/efi/vars.c | 11 +++++++----
 fs/efivarfs/super.c         |  4 ++++
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 010febd2ab6b..517bf886ba14 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -417,6 +417,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 	const struct efivar_operations *ops;
 	unsigned long variable_name_size = 512;
 	efi_char16_t *variable_name;
+	bool var_present = false;
 	efi_status_t status;
 	efi_guid_t vendor_guid;
 	int err = 0;
@@ -451,8 +452,12 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 						&vendor_guid);
 		switch (status) {
 		case EFI_SUCCESS:
-			if (duplicates)
+			if (duplicates) {
+				var_present = variable_is_present(variable_name,
+									&vendor_guid,
+									head);
 				up(&efivars_lock);
+			}
 
 			variable_name_size = var_name_strnsize(variable_name,
 							       variable_name_size);
@@ -465,9 +470,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 			 * we'll ever see a different variable name,
 			 * and may end up looping here forever.
 			 */
-			if (duplicates &&
-			    variable_is_present(variable_name, &vendor_guid,
-						head)) {
+			if (duplicates && var_present) {
 				dup_variable_bug(variable_name, &vendor_guid,
 						 variable_name_size);
 				status = EFI_NOT_FOUND;
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 24a0c5ef4169..7a6e2676b312 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -212,7 +212,11 @@ static int efivarfs_fill_super(struct super_block *sb, struct fs_context *fc)
 	if (!root)
 		return -ENOMEM;
 
+	err = efivar_entry_iter_begin();
+	if (err)
+		return err;
 	INIT_LIST_HEAD(&efivarfs_list);
+	efivar_entry_iter_end();
 
 	err = efivar_init(efivarfs_callback, (void *)sb, true, &efivarfs_list);
 	if (err)
-- 
2.43.0