diff options
| author | James Bottomley <[email protected]> | 2025-03-18 03:06:01 +0000 |
|---|---|---|
| committer | Ard Biesheuvel <[email protected]> | 2025-03-18 07:46:08 +0000 |
| commit | 11092db5b57377ac99e6339cfd16ca35ef011f3c (patch) | |
| tree | 826afcbcff13ec4d4b10b3535db7932dbdac01c8 /scripts/generate_rust_analyzer.py | |
| parent | efivarfs: use I_MUTEX_CHILD nested lock to traverse variables on resume (diff) | |
| download | kernel-11092db5b57377ac99e6339cfd16ca35ef011f3c.tar.gz kernel-11092db5b57377ac99e6339cfd16ca35ef011f3c.zip | |
efivarfs: fix NULL dereference on resume
LSMs often inspect the path.mnt of files in the security hooks, and this
causes a NULL deref in efivarfs_pm_notify() because the path is
constructed with a NULL path.mnt.
Fix by obtaining from vfs_kern_mount() instead, and being very careful
to ensure that deactivate_super() (potentially triggered by a racing
userspace umount) is not called directly from the notifier, because it
would deadlock when efivarfs_kill_sb() tried to unregister the notifier
chain.
[ Al notes:
Umm... That's probably safe, but not as a long-term solution -
it's too intimately dependent upon fs/super.c internals. The
reasons why you can't run into ->s_umount deadlock here are
non-trivial... ]
Cc: Al Viro <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Link: https://lore.kernel.org/r/3e998bf87638a442cbc6864cdcd3d8d9e08ce3e3.camel@HansenPartnership.com
Signed-off-by: Ard Biesheuvel <[email protected]>
Diffstat (limited to 'scripts/generate_rust_analyzer.py')
0 files changed, 0 insertions, 0 deletions
