Hi Alexander, Thanks for the feedback! On 5/6/25 7:36 오전, Al Viro wrote: > On Tue, May 06, 2025 at 05:38:02AM +0900, Yunseong Kim wrote: >> The function alloc_fs_context() assumes that current->nsproxy and its >> net_ns field are valid. However, this assumption can be violated in >> cases such as task teardown during do_exit(), where current->nsproxy can >> be NULL or already cleared. >> >> This issue was triggered during stress-ng's kernel-coverage.sh testing, >> Since alloc_fs_context() can be invoked in various contexts — including >> from asynchronous or teardown paths like do_exit() — it's difficult to >> guarantee that its input arguments are always valid. >> >> A follow-up patch will improve the granularity of this fix by moving the >> check closer to the actual mount trigger(e.g., in efivarfs_pm_notify()). > > UGH. > >> diff --git a/fs/fs_context.c b/fs/fs_context.c >> index 582d33e81117..529de43b8b5e 100644 >> --- a/fs/fs_context.c >> +++ b/fs/fs_context.c >> @@ -282,6 +282,9 @@ static struct fs_context *alloc_fs_context(struct file_system_type *fs_type, >> struct fs_context *fc; >> int ret = -ENOMEM; >> >> + if (!current->nsproxy || !current->nsproxy->net_ns) >> + return ERR_PTR(-EINVAL); >> + >> fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL_ACCOUNT); >> if (!fc) >> return ERR_PTR(-ENOMEM); > > That might paper over the oops, but I very much doubt that this will be > a correct fix... Note that in efivarfs_pm_notify() we have other > fun issues when run from such context - have task_work_add() fail in > fput() and if delayed_fput() runs right afterwards and > efivar_init(efivarfs_check_missing, sfi->sb, false); > in there might end up with UAF... I see your point — simply returning early in alloc_fs_context() may just paper over a deeper issue, and I agree that this might not be the right long-term fix. I wasn’t aware of the potential UAF scenario involving efivarfs_pm_notify() and delayed_fput(). I’ll take a closer look at the call paths involved here, especially around efivarfs_pm_notify(), fput(), and delayed_fput() interactions during do_exit(). Also, I’ll loop in the EFI mailing list so we can discuss this further from the efivarfs side as well. Thanks again, Yunseong
