[PATCH 5.10 1/2] efi: vars: Use locking version to iterate over efivars linked lists

[PATCH 5.10 1/2] efi: vars: Use locking version to iterate over efivars linked lists

[Alexey Nepomnyashih]

From: Ard Biesheuvel <ardb@kernel.org>

commit 3a75f9f2f9ad19bb9a0f566373ae91d8f09db85e upstream.

Both efivars and efivarfs uses __efivar_entry_iter() to go over the
linked list that shadows the list of EFI variables held by the firmware,
but fail to call the begin/end helpers that are documented as a
prerequisite.

So switch to the proper version, which is efivar_entry_iter(). Given
that in both cases, efivar_entry_remove() is invoked with the lock held
already, don't take the lock there anymore.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru>
---
 drivers/firmware/efi/efivars.c | 8 ++------
 drivers/firmware/efi/vars.c    | 9 +--------
 fs/efivarfs/super.c            | 9 +++------
 include/linux/efi.h            | 3 ++-
 4 files changed, 8 insertions(+), 21 deletions(-)

diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index e6b16b3a17a8..b925571ee593 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -608,10 +608,7 @@ static int efivars_sysfs_callback(efi_char16_t *name, efi_guid_t vendor,
 
 static int efivar_sysfs_destroy(struct efivar_entry *entry, void *data)
 {
-	int err = efivar_entry_remove(entry);
-
-	if (err)
-		return err;
+	efivar_entry_remove(entry);
 	efivar_unregister(entry);
 	return 0;
 }
@@ -621,8 +618,7 @@ static void efivars_sysfs_exit(void)
 	/* Remove all entries and destroy */
 	int err;
 
-	err = __efivar_entry_iter(efivar_sysfs_destroy, &efivar_sysfs_list,
-				  NULL, NULL);
+	err = efivar_entry_iter(efivar_sysfs_destroy, &efivar_sysfs_list, NULL);
 	if (err) {
 		pr_err("efivars: Failed to destroy sysfs entries\n");
 		return;
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index eaed1ddcc803..010febd2ab6b 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -534,17 +534,10 @@ EXPORT_SYMBOL_GPL(efivar_entry_add);
 /**
  * efivar_entry_remove - remove entry from variable list
  * @entry: entry to remove from list
- *
- * Returns 0 on success, or a kernel error code on failure.
  */
-int efivar_entry_remove(struct efivar_entry *entry)
+void efivar_entry_remove(struct efivar_entry *entry)
 {
-	if (down_interruptible(&efivars_lock))
-		return -EINTR;
 	list_del(&entry->list);
-	up(&efivars_lock);
-
-	return 0;
 }
 EXPORT_SYMBOL_GPL(efivar_entry_remove);
 
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 99d002438008..24a0c5ef4169 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -180,10 +180,7 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
 
 static int efivarfs_destroy(struct efivar_entry *entry, void *data)
 {
-	int err = efivar_entry_remove(entry);
-
-	if (err)
-		return err;
+	efivar_entry_remove(entry);
 	kfree(entry);
 	return 0;
 }
@@ -219,7 +216,7 @@ static int efivarfs_fill_super(struct super_block *sb, struct fs_context *fc)
 
 	err = efivar_init(efivarfs_callback, (void *)sb, true, &efivarfs_list);
 	if (err)
-		__efivar_entry_iter(efivarfs_destroy, &efivarfs_list, NULL, NULL);
+		efivar_entry_iter(efivarfs_destroy, &efivarfs_list, NULL);
 
 	return err;
 }
@@ -255,7 +252,7 @@ static void efivarfs_kill_sb(struct super_block *sb)
 	kill_litter_super(sb);
 
 	/* Remove all entries and destroy */
-	__efivar_entry_iter(efivarfs_destroy, &efivarfs_list, NULL, NULL);
+	efivar_entry_iter(efivarfs_destroy, &efivarfs_list, NULL);
 }
 
 static struct file_system_type efivarfs_type = {
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 5554d26f91d8..7c5beec4287a 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -994,7 +994,8 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 		void *data, bool duplicates, struct list_head *head);
 
 int efivar_entry_add(struct efivar_entry *entry, struct list_head *head);
-int efivar_entry_remove(struct efivar_entry *entry);
+void __efivar_entry_add(struct efivar_entry *entry, struct list_head *head);
+void efivar_entry_remove(struct efivar_entry *entry);
 
 int __efivar_entry_delete(struct efivar_entry *entry);
 int efivar_entry_delete(struct efivar_entry *entry);
-- 
2.43.0

[PATCH 5.10 2/2] efivarfs: Add efivars_lock to synchronize list operations

[Alexey Nepomnyashih]

No upstream commit exists for this patch.
    
The bug was fixed by upstream commit cdb46a8aefbf ("efivarfs: Move
efivarfs list into superblock s_fs_info") but it depends on major changes
done in the mainline kernel and 5.10.y needs its own patch.

Add locking around efivarfs_list operations to prevent race conditions
during processing of multiple filesystem superblock instances.

list_del corruption. prev->next should be ffff0000d86d6828, but was ffff800016216e60. (prev=ffff800016216e60)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4299 Comm: syz-executor237 Not tainted 6.1.119-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
lr : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
Call trace:
__list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
__list_del_entry include/linux/list.h:134 [inline]
list_del include/linux/list.h:148 [inline]
efivar_entry_remove+0x38/0x110 fs/efivarfs/vars.c:493
efivarfs_destroy+0x20/0x3c fs/efivarfs/super.c:184
efivar_entry_iter+0x94/0xdc fs/efivarfs/vars.c:720
efivarfs_kill_sb+0x58/0x70 fs/efivarfs/super.c:258
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193

Reported-by: syzbot+246ea4feed277471958a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=246ea4feed277471958a
Fixes: e14ab23dde12 ("efivars: efivar_entry API")
Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru>
---
 drivers/firmware/efi/vars.c | 11 +++++++----
 fs/efivarfs/super.c         |  4 ++++
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 010febd2ab6b..517bf886ba14 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -417,6 +417,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 	const struct efivar_operations *ops;
 	unsigned long variable_name_size = 512;
 	efi_char16_t *variable_name;
+	bool var_present = false;
 	efi_status_t status;
 	efi_guid_t vendor_guid;
 	int err = 0;
@@ -451,8 +452,12 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 						&vendor_guid);
 		switch (status) {
 		case EFI_SUCCESS:
-			if (duplicates)
+			if (duplicates) {
+				var_present = variable_is_present(variable_name,
+									&vendor_guid,
+									head);
 				up(&efivars_lock);
+			}
 
 			variable_name_size = var_name_strnsize(variable_name,
 							       variable_name_size);
@@ -465,9 +470,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 			 * we'll ever see a different variable name,
 			 * and may end up looping here forever.
 			 */
-			if (duplicates &&
-			    variable_is_present(variable_name, &vendor_guid,
-						head)) {
+			if (duplicates && var_present) {
 				dup_variable_bug(variable_name, &vendor_guid,
 						 variable_name_size);
 				status = EFI_NOT_FOUND;
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 24a0c5ef4169..7a6e2676b312 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -212,7 +212,11 @@ static int efivarfs_fill_super(struct super_block *sb, struct fs_context *fc)
 	if (!root)
 		return -ENOMEM;
 
+	err = efivar_entry_iter_begin();
+	if (err)
+		return err;
 	INIT_LIST_HEAD(&efivarfs_list);
+	efivar_entry_iter_end();
 
 	err = efivar_init(efivarfs_callback, (void *)sb, true, &efivarfs_list);
 	if (err)
-- 
2.43.0