Re: [PATCH] efivarfs: fix NULL dereference on resume

Al Viro
2025-03-18T03:37:40Z

On Mon, Mar 17, 2025 at 11:06:01PM -0400, James Bottomley wrote:

> + /* ensure single superblock is alive and pin it */
> + if (!atomic_inc_not_zero(&s->s_active))
> + return NOTIFY_DONE;
> +
> pr_info("efivarfs: resyncing variable state\n");
>
> - /* O_NOATIME is required to prevent oops on NULL mnt */
> + path.dentry = sfi->sb->s_root;
> +
> + /*
> + * do not add SB_KERNMOUNT which a single superblock could
> + * expose to userspace and which also causes MNT_INTERNAL, see
> + * below
> + */
> + path.mnt = vfs_kern_mount(&efivarfs_type, 0,
> + efivarfs_type.name, NULL);

Umm... That's probably safe, but not as a long-term solution -
it's too intimately dependent upon fs/super.c internals.
The reasons why you can't run into ->s_umount deadlock here
are non-trivial...