Re: [PATCH] fs: Prevent panic from NULL dereference in alloc_fs_context() during do_exit()

[Yunseong Kim <ysk@kzalloc.com>]

Hi Christian,

On 5/6/25 5:45 오후, Christian Brauner wrote:
>>> diff --git a/fs/fs_context.c b/fs/fs_context.c
>>> index 582d33e81117..529de43b8b5e 100644
>>> --- a/fs/fs_context.c
>>> +++ b/fs/fs_context.c
>>> @@ -282,6 +282,9 @@ static struct fs_context *alloc_fs_context(struct file_system_type *fs_type,
>>>  	struct fs_context *fc;
>>>  	int ret = -ENOMEM;
>>>  
>>> +	if (!current->nsproxy || !current->nsproxy->net_ns)
>>> +		return ERR_PTR(-EINVAL);
>>> +
>>>  	fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL_ACCOUNT);
>>>  	if (!fc)
>>>  		return ERR_PTR(-ENOMEM);
>>
>> That might paper over the oops, but I very much doubt that this will be
>> a correct fix...  Note that in efivarfs_pm_notify() we have other
>> fun issues when run from such context - have task_work_add() fail in
>> fput() and if delayed_fput() runs right afterwards and
>>         efivar_init(efivarfs_check_missing, sfi->sb, false);
>> in there might end up with UAF...
> 
> We've already accepted a patch that removes the need for
> vfs_kern_mount() from efivarfs completely.

I’ll take a look at the patch you mentioned, check if the issue reproduces, and get back to you.

Link: https://lore.kernel.org/all/20250318194111.19419-4-James.Bottomley@HansenPartnership.com/

Thanks for checking it!

Best regards,
Yunseong Kim