On Tue, Oct 15, 2019 at 09:09:02PM +0300, Pavel V. Panteleev wrote: > Hello, > > copy_mount_options() checks that data doesn't cross TASK_SIZE boundary. It's > not correct. Really it should check USER_DS boudary, because some archs have > TASK_SIZE not equal to USER_DS. In this case (USER_DS != TASK_SIZE) > exact_copy_from_user() will stop on access_ok() check, if data cross > USER_DS, but doesn't cross TASK_SIZE. Details of the call chain, please.
