Re: copy_mount_options()

[Benjamin Herrenschmidt <benh@kernel.crashing.org>]

On Sat, 2004-08-21 at 06:01, David S. Miller wrote:
> So the sparc64 user copy bug I fixed recently is pretty
> much present on every platform.
> 
> Basically, copy_mount_options() requires exact byte granularity
> to exception reporting from copy_from_user().  If you don't
> do this it can break things like busybox's mount().

Yup, old problem, reported before several times. Another issue
that pops up with it and busybox is that copy_mount_options will
touch an entire page from the passed pointer. If the pointer you
pass is near the end of your data/bss area, you end up touching
the area between stack and bss, and potentially cause the stack
to grow all the way down to the bss.

We have saveguards against that now on ppc, I suppose x86 has too,
but it may be worth reminding other archs to have a look.

> Even reporting on a word boundary is illegal.  On sparc64
> it was quite poignant because we can report on a 64-byte
> boundary for large copies because that is the granularity
> of the load/store we use.
> 
> Other platforms will need to fix this.  I recommend a two
> stage exception handling scheme.  Basically, on the first
> exception, you merely note that an exception occurred
> and you retry the user copy a byte at a time until you
> hit the exact address that fails.  You cannot optimize
> this to just check a page at a time, because copy_mount_options
> wants all the data to be there.
-- 
Benjamin Herrenschmidt <benh@kernel.crashing.org>