Re: [PATCH 3/3] init: use do_mount() instead of ksys_mount()

From: Geert Uytterhoeven
Date: Mon Dec 16 2019 - 08:22:29 EST


Hi all,

On Mon, Dec 16, 2019 at 6:13 AM Eric Biggers <ebiggers@xxxxxxxxxx> wrote:
> On Sun, Dec 15, 2019 at 07:50:23PM -0800, Linus Torvalds wrote:
> > On Sun, Dec 15, 2019 at 5:35 PM OndÅej Jirman <megi@xxxxxx> wrote:
> > > Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> >
> > Duh. So much for the trivial obvious conversion.
> >
> > It didn't take "data might be NULL" into account.
> >
> > A patch like this, perhaps? Untested..

> > --- a/init/do_mounts.c
> > +++ b/init/do_mounts.c
> > @@ -391,17 +391,19 @@ static int __init do_mount_root(const char *name, const char *fs,
> > const int flags, const void *data)
> > {
> > struct super_block *s;
> > - char *data_page;
> > - struct page *p;
> > + struct page *p = NULL;
> > + char *data_page = NULL;
> > int ret;
> >
> > - /* do_mount() requires a full page as fifth argument */
> > - p = alloc_page(GFP_KERNEL);
> > - if (!p)
> > - return -ENOMEM;
> > -
> > - data_page = page_address(p);
> > - strncpy(data_page, data, PAGE_SIZE - 1);
> > + if (data) {
> > + /* do_mount() requires a full page as fifth argument */
> > + p = alloc_page(GFP_KERNEL);
> > + if (!p)
> > + return -ENOMEM;
> > + data_page = page_address(p);
> > + strncpy(data_page, data, PAGE_SIZE - 1);
> > + data_page[PAGE_SIZE - 1] = '\0';
> > + }
> >
> > ret = do_mount(name, "/root", fs, flags, data_page);
> > if (ret)
> > @@ -417,7 +419,8 @@ static int __init do_mount_root(const char *name, const char *fs,
> > MAJOR(ROOT_DEV), MINOR(ROOT_DEV));
> >
> > out:
> > - put_page(p);
> > + if (p)
> > + put_page(p);
> > return ret;
>
> I'm seeing the boot crash too, and Linus' patch fixes it.

#metoo ;-)

Tested-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>

> Note that adding the line
>
> data_page[PAGE_SIZE - 1] = '\0';
>
> is not necessary since do_mount() already does it.

Indeed. So the "-1" can be dropped from the strncpy() call, which brings
it even more in-line with the "full page" comment.

Gr{oetje,eeting}s,

Geert


--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds