[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250506-hochphase-kicken-7fa895216c2a@brauner>
Date: Tue, 6 May 2025 10:45:22 +0200
From: Christian Brauner <brauner@...nel.org>
To: Al Viro <viro@...iv.linux.org.uk>
Cc: Yunseong Kim <ysk@...lloc.com>, Jan Kara <jack@...e.cz>,
"Rafael J. Wysocki" <rafael@...nel.org>, Pavel Machek <pavel@...nel.org>, Len Brown <len.brown@...el.com>,
byungchul@...com, max.byungchul.park@...il.com, linux-fsdevel@...r.kernel.org,
linux-pm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] fs: Prevent panic from NULL dereference in
alloc_fs_context() during do_exit()
On Mon, May 05, 2025 at 11:36:15PM +0100, Al Viro wrote:
> On Tue, May 06, 2025 at 05:38:02AM +0900, Yunseong Kim wrote:
> > The function alloc_fs_context() assumes that current->nsproxy and its
> > net_ns field are valid. However, this assumption can be violated in
> > cases such as task teardown during do_exit(), where current->nsproxy can
> > be NULL or already cleared.
> >
> > This issue was triggered during stress-ng's kernel-coverage.sh testing,
> > Since alloc_fs_context() can be invoked in various contexts — including
> > from asynchronous or teardown paths like do_exit() — it's difficult to
> > guarantee that its input arguments are always valid.
> >
> > A follow-up patch will improve the granularity of this fix by moving the
> > check closer to the actual mount trigger(e.g., in efivarfs_pm_notify()).
>
> UGH.
>
> > diff --git a/fs/fs_context.c b/fs/fs_context.c
> > index 582d33e81117..529de43b8b5e 100644
> > --- a/fs/fs_context.c
> > +++ b/fs/fs_context.c
> > @@ -282,6 +282,9 @@ static struct fs_context *alloc_fs_context(struct file_system_type *fs_type,
> > struct fs_context *fc;
> > int ret = -ENOMEM;
> >
> > + if (!current->nsproxy || !current->nsproxy->net_ns)
> > + return ERR_PTR(-EINVAL);
> > +
> > fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL_ACCOUNT);
> > if (!fc)
> > return ERR_PTR(-ENOMEM);
>
> That might paper over the oops, but I very much doubt that this will be
> a correct fix... Note that in efivarfs_pm_notify() we have other
> fun issues when run from such context - have task_work_add() fail in
> fput() and if delayed_fput() runs right afterwards and
> efivar_init(efivarfs_check_missing, sfi->sb, false);
> in there might end up with UAF...
We've already accepted a patch that removes the need for
vfs_kern_mount() from efivarfs completely.
Powered by blists - more mailing lists