Re: [PATCH v2 1/2] fs: Improve and simplify copy_mount_options

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jun 16, 2016 at 09:25:57AM +0200, Willy Tarreau wrote:
> On Thu, Jun 16, 2016 at 08:08:22AM +0100, Al Viro wrote:
> > On Thu, Jun 16, 2016 at 08:57:38AM +0200, Willy Tarreau wrote:
> > > +	type = get_fs_type(fstype);
> > > +	if (!type)
> > > +		return NULL;
> > > +
> > >  	copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
> > >  	if (!copy)
> > >  		return ERR_PTR(-ENOMEM);
> > >  
> > > +	/* avoid reading a whole page if the FS only needs a string. */
> > > +	if (!(type->fs_flags & FS_BINARY_MOUNTDATA)) {
> > > +		strlcpy(copy, data, PAGE_SIZE);
> > > +		return copy;
> > 
> > a) it leaks a file_system_type reference
> 
> I was not sure about this one, thanks for confirming.
> 
> > b) data is a userland pointer, for crying out loud!
> 
> Yep I noticed it and fixed it after sending. I was focused on the
> data coming from kernel due to the discussion.
> 
> I also think that since there are only two call places for
> copy_mount_options(), we may move the test there and switch
> to copy_mount_string() instead depending on the fs type.

Another problem is that it will oops with NULL fstype, which is
absolutely normal both for mount --bind *and* mount -o remount.
And while mount --bind doesn't care about string options,
mount -o remount certainly does.  IMO the latter makes that
approach hopeless - with remount you don't know the type
until well into do_mount() guts and I'd really hate to carry
the userland pointer all the way into it.
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux