From: Willy Tarreau <w@1wt.eu>
To: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Andy Lutomirski <luto@amacapital.net>,
Andy Lutomirski <luto@kernel.org>,
Linux FS Devel <linux-fsdevel@vger.kernel.org>,
Stephen Rothwell <sfr@canb.auug.org.au>,
Andrew Morton <akpm@linux-foundation.org>,
stable <stable@vger.kernel.org>
Subject: Re: [PATCH v2 1/2] fs: Improve and simplify copy_mount_options
Date: Thu, 16 Jun 2016 09:25:57 +0200 [thread overview]
Message-ID: <20160616072557.GA7336@1wt.eu> (raw)
In-Reply-To: <20160616070821.GB14480@ZenIV.linux.org.uk>
On Thu, Jun 16, 2016 at 08:08:22AM +0100, Al Viro wrote:
> On Thu, Jun 16, 2016 at 08:57:38AM +0200, Willy Tarreau wrote:
> > + type = get_fs_type(fstype);
> > + if (!type)
> > + return NULL;
> > +
> > copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
> > if (!copy)
> > return ERR_PTR(-ENOMEM);
> >
> > + /* avoid reading a whole page if the FS only needs a string. */
> > + if (!(type->fs_flags & FS_BINARY_MOUNTDATA)) {
> > + strlcpy(copy, data, PAGE_SIZE);
> > + return copy;
>
> a) it leaks a file_system_type reference
I was not sure about this one, thanks for confirming.
> b) data is a userland pointer, for crying out loud!
Yep I noticed it and fixed it after sending. I was focused on the
data coming from kernel due to the discussion.
I also think that since there are only two call places for
copy_mount_options(), we may move the test there and switch
to copy_mount_string() instead depending on the fs type.
Thanks,
Willy
next prev parent reply other threads:[~2016-06-16 7:25 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-14 2:36 [PATCH v2 0/2] copy_mount_options improvements Andy Lutomirski
2016-06-14 2:36 ` [PATCH v2 1/2] fs: Improve and simplify copy_mount_options Andy Lutomirski
2016-06-15 23:50 ` Al Viro
2016-06-16 0:01 ` Andy Lutomirski
2016-06-16 0:42 ` Linus Torvalds
2016-06-16 5:45 ` Willy Tarreau
2016-06-16 5:59 ` Linus Torvalds
2016-06-16 6:57 ` Willy Tarreau
2016-06-16 7:02 ` Willy Tarreau
2016-06-16 7:08 ` Al Viro
2016-06-16 7:25 ` Willy Tarreau [this message]
2016-06-16 8:02 ` Al Viro
2016-06-16 8:20 ` Willy Tarreau
2016-06-16 8:38 ` Willy Tarreau
2016-06-17 3:12 ` Andy Lutomirski
2016-06-14 2:36 ` [PATCH v2 2/2] fs: Disallow mount options strings longer than PAGE_SIZE - 1 Andy Lutomirski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160616072557.GA7336@1wt.eu \
--to=w@1wt.eu \
--cc=akpm@linux-foundation.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=luto@kernel.org \
--cc=sfr@canb.auug.org.au \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).