@@ -417,6 +417,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
const struct efivar_operations *ops;
unsigned long variable_name_size = 512;
efi_char16_t *variable_name;
+ bool var_present = false;
efi_status_t status;
efi_guid_t vendor_guid;
int err = 0;
@@ -451,8 +452,12 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
&vendor_guid);
switch (status) {
case EFI_SUCCESS:
- if (duplicates)
+ if (duplicates) {
+ var_present = variable_is_present(variable_name,
+ &vendor_guid,
+ head);
up(&efivars_lock);
+ }
variable_name_size = var_name_strnsize(variable_name,
variable_name_size);
@@ -465,9 +470,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
* we'll ever see a different variable name,
* and may end up looping here forever.
*/
- if (duplicates &&
- variable_is_present(variable_name, &vendor_guid,
- head)) {
+ if (duplicates && var_present) {
dup_variable_bug(variable_name, &vendor_guid,
variable_name_size);
status = EFI_NOT_FOUND;
@@ -212,7 +212,11 @@ static int efivarfs_fill_super(struct super_block *sb, struct fs_context *fc)
if (!root)
return -ENOMEM;
+ err = efivar_entry_iter_begin();
+ if (err)
+ return err;
INIT_LIST_HEAD(&efivarfs_list);
+ efivar_entry_iter_end();
err = efivar_init(efivarfs_callback, (void *)sb, true, &efivarfs_list);
if (err)
No upstream commit exists for this patch. The bug was fixed by upstream commit cdb46a8aefbf ("efivarfs: Move efivarfs list into superblock s_fs_info") but it depends on major changes done in the mainline kernel and 5.10.y needs its own patch. Add locking around efivarfs_list operations to prevent race conditions during processing of multiple filesystem superblock instances. list_del corruption. prev->next should be ffff0000d86d6828, but was ffff800016216e60. (prev=ffff800016216e60) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:61! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4299 Comm: syz-executor237 Not tainted 6.1.119-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59 lr : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59 Call trace: __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59 __list_del_entry include/linux/list.h:134 [inline] list_del include/linux/list.h:148 [inline] efivar_entry_remove+0x38/0x110 fs/efivarfs/vars.c:493 efivarfs_destroy+0x20/0x3c fs/efivarfs/super.c:184 efivar_entry_iter+0x94/0xdc fs/efivarfs/vars.c:720 efivarfs_kill_sb+0x58/0x70 fs/efivarfs/super.c:258 deactivate_locked_super+0xac/0x124 fs/super.c:332 deactivate_super+0xf0/0x110 fs/super.c:363 cleanup_mnt+0x394/0x41c fs/namespace.c:1186 __cleanup_mnt+0x20/0x30 fs/namespace.c:1193 Reported-by: syzbot+246ea4feed277471958a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=246ea4feed277471958a Fixes: e14ab23dde12 ("efivars: efivar_entry API") Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru> --- drivers/firmware/efi/vars.c | 11 +++++++---- fs/efivarfs/super.c | 4 ++++ 2 files changed, 11 insertions(+), 4 deletions(-)