On Thu, Jun 16, 2016 at 08:08:22AM +0100, Al Viro wrote:
> On Thu, Jun 16, 2016 at 08:57:38AM +0200, Willy Tarreau wrote:
> > + type = get_fs_type(fstype);
> > + if (!type)
> > + return NULL;
> > +
> > copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
> > if (!copy)
> > return ERR_PTR(-ENOMEM);
> >
> > + /* avoid reading a whole page if the FS only needs a string. */
> > + if (!(type->fs_flags & FS_BINARY_MOUNTDATA)) {
> > + strlcpy(copy, data, PAGE_SIZE);
> > + return copy;
>
> a) it leaks a file_system_type reference
I was not sure about this one, thanks for confirming.
> b) data is a userland pointer, for crying out loud!
Yep I noticed it and fixed it after sending. I was focused on the
data coming from kernel due to the discussion.
I also think that since there are only two call places for
copy_mount_options(), we may move the test there and switch
to copy_mount_string() instead depending on the fs type.
Thanks,
Willy
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html