linux-kernel - Re: [PATCH] fs: Prevent panic from NULL dereference in alloc_fs_context() during do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <81a917f3-fb41-4958-8d76-7cdfa7b60a7c@kzalloc.com>
Date: Tue, 6 May 2025 07:58:18 +0900
From: Yunseong Kim <ysk@...lloc.com>
To: Al Viro <viro@...iv.linux.org.uk>
Cc: Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
 "Rafael J. Wysocki" <rafael@...nel.org>, Pavel Machek <pavel@...nel.org>,
 Len Brown <len.brown@...el.com>, byungchul@...com,
 max.byungchul.park@...il.com, linux-fsdevel@...r.kernel.org,
 linux-pm@...r.kernel.org, linux-kernel@...r.kernel.org,
 Jeremy Kerr <jk@...abs.org>, Ard Biesheuvel <ardb@...nel.org>,
 linux-efi@...r.kernel.org
Subject: Re: [PATCH] fs: Prevent panic from NULL dereference in
 alloc_fs_context() during do_exit()

Hi Alexander,

Thanks for the feedback!

On 5/6/25 7:36 오전, Al Viro wrote:
> On Tue, May 06, 2025 at 05:38:02AM +0900, Yunseong Kim wrote:
>> The function alloc_fs_context() assumes that current->nsproxy and its
>> net_ns field are valid. However, this assumption can be violated in
>> cases such as task teardown during do_exit(), where current->nsproxy can
>> be NULL or already cleared.
>>
>> This issue was triggered during stress-ng's kernel-coverage.sh testing,
>> Since alloc_fs_context() can be invoked in various contexts — including
>> from asynchronous or teardown paths like do_exit() — it's difficult to
>> guarantee that its input arguments are always valid.
>>
>> A follow-up patch will improve the granularity of this fix by moving the
>> check closer to the actual mount trigger(e.g., in efivarfs_pm_notify()).
> 
> UGH.
> 
>> diff --git a/fs/fs_context.c b/fs/fs_context.c
>> index 582d33e81117..529de43b8b5e 100644
>> --- a/fs/fs_context.c
>> +++ b/fs/fs_context.c
>> @@ -282,6 +282,9 @@ static struct fs_context *alloc_fs_context(struct file_system_type *fs_type,
>>  	struct fs_context *fc;
>>  	int ret = -ENOMEM;
>>  
>> +	if (!current->nsproxy || !current->nsproxy->net_ns)
>> +		return ERR_PTR(-EINVAL);
>> +
>>  	fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL_ACCOUNT);
>>  	if (!fc)
>>  		return ERR_PTR(-ENOMEM);
> 
> That might paper over the oops, but I very much doubt that this will be
> a correct fix...  Note that in efivarfs_pm_notify() we have other
> fun issues when run from such context - have task_work_add() fail in
> fput() and if delayed_fput() runs right afterwards and
>         efivar_init(efivarfs_check_missing, sfi->sb, false);
> in there might end up with UAF...

I see your point — simply returning early in alloc_fs_context() may just
paper over a deeper issue, and I agree that this might not be the right
long-term fix. I wasn’t aware of the potential UAF scenario involving
efivarfs_pm_notify() and delayed_fput().

I’ll take a closer look at the call paths involved here, especially
around efivarfs_pm_notify(), fput(), and delayed_fput() interactions
during do_exit().

Also, I’ll loop in the EFI mailing list so we can discuss this
further from the efivarfs side as well.

Thanks again,
Yunseong