linux-kernel - Re: [PATCH] fs: Prevent panic from NULL dereference in alloc_fs_context() during do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4dcff9ce-4ec8-4b57-9f21-a7e2f37b4d5c@kzalloc.com>
Date: Tue, 6 May 2025 18:42:21 +0900
From: Yunseong Kim <ysk@...lloc.com>
To: Christian Brauner <brauner@...nel.org>, Al Viro <viro@...iv.linux.org.uk>
Cc: Jan Kara <jack@...e.cz>, "Rafael J. Wysocki" <rafael@...nel.org>,
 Pavel Machek <pavel@...nel.org>, Len Brown <len.brown@...el.com>,
 byungchul@...com, max.byungchul.park@...il.com,
 linux-fsdevel@...r.kernel.org, linux-pm@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] fs: Prevent panic from NULL dereference in
 alloc_fs_context() during do_exit()

Hi Christian,

On 5/6/25 5:45 오후, Christian Brauner wrote:
>>> diff --git a/fs/fs_context.c b/fs/fs_context.c
>>> index 582d33e81117..529de43b8b5e 100644
>>> --- a/fs/fs_context.c
>>> +++ b/fs/fs_context.c
>>> @@ -282,6 +282,9 @@ static struct fs_context *alloc_fs_context(struct file_system_type *fs_type,
>>>  	struct fs_context *fc;
>>>  	int ret = -ENOMEM;
>>>  
>>> +	if (!current->nsproxy || !current->nsproxy->net_ns)
>>> +		return ERR_PTR(-EINVAL);
>>> +
>>>  	fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL_ACCOUNT);
>>>  	if (!fc)
>>>  		return ERR_PTR(-ENOMEM);
>>
>> That might paper over the oops, but I very much doubt that this will be
>> a correct fix...  Note that in efivarfs_pm_notify() we have other
>> fun issues when run from such context - have task_work_add() fail in
>> fput() and if delayed_fput() runs right afterwards and
>>         efivar_init(efivarfs_check_missing, sfi->sb, false);
>> in there might end up with UAF...
> 
> We've already accepted a patch that removes the need for
> vfs_kern_mount() from efivarfs completely.

I’ll take a look at the patch you mentioned, check if the issue reproduces, and get back to you.

Link: https://lore.kernel.org/all/20250318194111.19419-4-James.Bottomley@HansenPartnership.com/

Thanks for checking it!

Best regards,
Yunseong Kim