lkml.org 
[lkml]   [2019]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH 3/3] init: use do_mount() instead of ksys_mount()
Hi all,

On Mon, Dec 16, 2019 at 6:13 AM Eric Biggers <ebiggers@kernel.org> wrote:
> On Sun, Dec 15, 2019 at 07:50:23PM -0800, Linus Torvalds wrote:
> > On Sun, Dec 15, 2019 at 5:35 PM Ondřej Jirman <megi@xff.cz> wrote:
> > > Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> >
> > Duh. So much for the trivial obvious conversion.
> >
> > It didn't take "data might be NULL" into account.
> >
> > A patch like this, perhaps? Untested..

> > --- a/init/do_mounts.c
> > +++ b/init/do_mounts.c
> > @@ -391,17 +391,19 @@ static int __init do_mount_root(const char *name, const char *fs,
> > const int flags, const void *data)
> > {
> > struct super_block *s;
> > - char *data_page;
> > - struct page *p;
> > + struct page *p = NULL;
> > + char *data_page = NULL;
> > int ret;
> >
> > - /* do_mount() requires a full page as fifth argument */
> > - p = alloc_page(GFP_KERNEL);
> > - if (!p)
> > - return -ENOMEM;
> > -
> > - data_page = page_address(p);
> > - strncpy(data_page, data, PAGE_SIZE - 1);
> > + if (data) {
> > + /* do_mount() requires a full page as fifth argument */
> > + p = alloc_page(GFP_KERNEL);
> > + if (!p)
> > + return -ENOMEM;
> > + data_page = page_address(p);
> > + strncpy(data_page, data, PAGE_SIZE - 1);
> > + data_page[PAGE_SIZE - 1] = '\0';
> > + }
> >
> > ret = do_mount(name, "/root", fs, flags, data_page);
> > if (ret)
> > @@ -417,7 +419,8 @@ static int __init do_mount_root(const char *name, const char *fs,
> > MAJOR(ROOT_DEV), MINOR(ROOT_DEV));
> >
> > out:
> > - put_page(p);
> > + if (p)
> > + put_page(p);
> > return ret;
>
> I'm seeing the boot crash too, and Linus' patch fixes it.

#metoo ;-)

Tested-by: Geert Uytterhoeven <geert@linux-m68k.org>

> Note that adding the line
>
> data_page[PAGE_SIZE - 1] = '\0';
>
> is not necessary since do_mount() already does it.

Indeed. So the "-1" can be dropped from the strncpy() call, which brings
it even more in-line with the "full page" comment.

Gr{oetje,eeting}s,

Geert


--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds

\
 
 \ /
  Last update: 2019-12-16 14:22    [W:0.047 / U:8.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site