Re: copy_mount_options()

[Rusty Russell <rusty@rustcorp.com.au>]

On Sat, 2004-08-21 at 10:07, Andrew Morton wrote:
> I'm all for it.  I'll sneak the below patch into -mm, see what breaks.

You should zero out the whole buffer in copy_from_user() if you return
-EFAULT.  We had bugs where people didn't check the returns and you
could read random junk.

As to who uses the value, generic file read and write still use it, as
did some of the serial code last I checked.  Linus was of the belief
that they should do a short read/write up to the fault boundary rather
than return -EFAULT.

There's evidence that noone relies on such behaviour, though, since at
the time of the debate, doing such a thing would cause an OOPS on ppc. 
Also, this behaviour silently changed after 2.0 and noone noticed. 
Finally, other unixes are varied in their approaches in this case (some
downright buggy, lying about how much they'd written).

I would humbly suggest an additional option which sent a SEGV to the
process, as well.  If you were playing mprotect games you'd expect them,
and if you weren't, you're probably buggy.  After a while, we can simply
forget about checking returns from copy_to/from_user, which would be a
blissful simplification of kernel code.

Cheers,
Rusty.
-- 
Anyone who quotes me in their signature is an idiot -- Rusty Russell