From patchwork Thu Jun 16 05:45:25 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Willy Tarreau X-Patchwork-Id: 9179849 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BE44B60760 for ; Thu, 16 Jun 2016 05:45:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AFA6927DA4 for ; Thu, 16 Jun 2016 05:45:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A3B3027E5A; Thu, 16 Jun 2016 05:45:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E06E927DA4 for ; Thu, 16 Jun 2016 05:45:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752192AbcFPFpn (ORCPT ); Thu, 16 Jun 2016 01:45:43 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:50460 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751397AbcFPFpl (ORCPT ); Thu, 16 Jun 2016 01:45:41 -0400 Received: (from willy@localhost) by pcw.home.local (8.15.2/8.15.2/Submit) id u5G5jPVo007076; Thu, 16 Jun 2016 07:45:25 +0200 Date: Thu, 16 Jun 2016 07:45:25 +0200 From: Willy Tarreau To: Linus Torvalds Cc: Andy Lutomirski , Al Viro , Andy Lutomirski , Linux FS Devel , Stephen Rothwell , Andrew Morton , stable Subject: Re: [PATCH v2 1/2] fs: Improve and simplify copy_mount_options Message-ID: <20160616054525.GA6803@1wt.eu> References: <20160615235047.GA14480@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Wed, Jun 15, 2016 at 02:42:33PM -1000, Linus Torvalds wrote: > On Wed, Jun 15, 2016 at 2:01 PM, Andy Lutomirski wrote: > > > > devtmpfsd does: > > > > *err = sys_mount("devtmpfs", "/", "devtmpfs", MS_SILENT, options); > > > > where options points to the kernel stack. This is bad. do_mount_root > > is similarly broken. > > > > Is there any reason that these things use sys_mount instead of do_mount? > > Not that I can see. But maybe copy_mount_options could also check for > KERNEL_DS, and use a strncpy instead of a copy_from_user() for that > case? Well, strncpy() would make the function behave differently depending on the FS being used if called from the kernel for the reason Al mentionned. OK devtmpfsd() passes a string, but if it's the FS itself which decides to stop on a zero when parsing mount options, we'd probably rather use memcpy() instead to ensure a consistent behaviour, like this maybe ? Willy --- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/fs/namespace.c b/fs/namespace.c index 4fb1691..058b856 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2622,6 +2622,12 @@ void *copy_mount_options(const void __user * data) if (!copy) return ERR_PTR(-ENOMEM); + /* do_mount() may be called from the kernel */ + if (segment_eq(get_fs(), KERNEL_DS)) { + memcpy(copy, data, PAGE_SIZE); + return copy; + } + /* We only care that *some* data at the address the user * gave us is valid. Just in case, we'll zero * the remainder of the page.