Skip to content
Commit 11092db5 authored by James Bottomley's avatar James Bottomley Committed by Ard Biesheuvel
Browse files

efivarfs: fix NULL dereference on resume



LSMs often inspect the path.mnt of files in the security hooks, and this
causes a NULL deref in efivarfs_pm_notify() because the path is
constructed with a NULL path.mnt.

Fix by obtaining from vfs_kern_mount() instead, and being very careful
to ensure that deactivate_super() (potentially triggered by a racing
userspace umount) is not called directly from the notifier, because it
would deadlock when efivarfs_kill_sb() tried to unregister the notifier
chain.

[ Al notes:
	Umm...  That's probably safe, but not as a long-term solution -
	it's too intimately dependent upon fs/super.c internals. The
	reasons why you can't run into ->s_umount deadlock here are
	non-trivial... ]

Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
Link: https://lore.kernel.org/r/e54e6a2f-1178-4980-b771-4d9bafc2aa47@tnxip.de
Link: https://lore.kernel.org/r/3e998bf87638a442cbc6864cdcd3d8d9e08ce3e3.camel@HansenPartnership.com


Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
parent dec12778
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment