]> git.ipfire.org Git - thirdparty/linux.git/commit
efivarfs: fix NULL dereference on resume
authorJames Bottomley <James.Bottomley@HansenPartnership.com>
Tue, 18 Mar 2025 03:06:01 +0000 (23:06 -0400)
committerArd Biesheuvel <ardb@kernel.org>
Tue, 18 Mar 2025 07:46:08 +0000 (08:46 +0100)
commit11092db5b57377ac99e6339cfd16ca35ef011f3c
tree826afcbcff13ec4d4b10b3535db7932dbdac01c8
parentdec1277875a5974413068bfb67df7e87e51a189b
efivarfs: fix NULL dereference on resume

LSMs often inspect the path.mnt of files in the security hooks, and this
causes a NULL deref in efivarfs_pm_notify() because the path is
constructed with a NULL path.mnt.

Fix by obtaining from vfs_kern_mount() instead, and being very careful
to ensure that deactivate_super() (potentially triggered by a racing
userspace umount) is not called directly from the notifier, because it
would deadlock when efivarfs_kill_sb() tried to unregister the notifier
chain.

[ Al notes:
Umm...  That's probably safe, but not as a long-term solution -
it's too intimately dependent upon fs/super.c internals. The
reasons why you can't run into ->s_umount deadlock here are
non-trivial... ]

Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Link: https://lore.kernel.org/r/e54e6a2f-1178-4980-b771-4d9bafc2aa47@tnxip.de
Link: https://lore.kernel.org/r/3e998bf87638a442cbc6864cdcd3d8d9e08ce3e3.camel@HansenPartnership.com
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
fs/efivarfs/super.c