Re: [PATCH 3/3] init: use do_mount() instead of ksys_mount()

[OndÅej Jirman]

Hello,

On Thu, Dec 12, 2019 at 02:57:24PM +0100, Dominik Brodowski wrote:
> In prepare_namespace(), do_mount() can be used instead of ksys_mount()
> as the first and third argument are const strings in the kernel, the
> second and fourth argument are passed through anyway, and the fifth
> argument is NULL.
> 
> In do_mount_root(), ksys_mount() is called with the first and third
> argument being already kernelspace strings, which do not need to be
> copied over from userspace to kernelspace (again). The second and
> fourth arguments are passed through to do_mount() anyway. The fifth
> argument, while already residing in kernelspace, needs to be put into
> a page of its own. Then, do_mount() can be used instead of
> ksys_mount().
> 
> Once this is done, there are no in-kernel users to ksys_mount() left,
> which can therefore be removed.
> 
> Signed-off-by: Dominik Brodowski <linux@xxxxxxxxxxxxxxxxxxxx>
> ---
>  fs/namespace.c           | 10 ++--------
>  include/linux/syscalls.h |  2 --
>  init/do_mounts.c         | 28 ++++++++++++++++++++++------
>  3 files changed, 24 insertions(+), 16 deletions(-)
> 
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 2fd0c8bcb8c1..be601d3a8008 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -3325,8 +3325,8 @@ struct dentry *mount_subtree(struct vfsmount *m, const char *name)
>  }
>  EXPORT_SYMBOL(mount_subtree);
>  
> -int ksys_mount(const char __user *dev_name, const char __user *dir_name,
> -	       const char __user *type, unsigned long flags, void __user *data)
> +SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
> +		char __user *, type, unsigned long, flags, void __user *, data)
>  {
>  	int ret;
>  	char *kernel_type;
> @@ -3359,12 +3359,6 @@ int ksys_mount(const char __user *dev_name, const char __user *dir_name,
>  	return ret;
>  }
>  
> -SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
> -		char __user *, type, unsigned long, flags, void __user *, data)
> -{
> -	return ksys_mount(dev_name, dir_name, type, flags, data);
> -}
> -
>  /*
>   * Create a kernel mount representation for a new, prepared superblock
>   * (specified by fs_fd) and attach to an open_tree-like file descriptor.
> diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
> index d0391cc2dae9..5262b7a76d39 100644
> --- a/include/linux/syscalls.h
> +++ b/include/linux/syscalls.h
> @@ -1231,8 +1231,6 @@ asmlinkage long sys_ni_syscall(void);
>   * the ksys_xyzyyz() functions prototyped below.
>   */
>  
> -int ksys_mount(const char __user *dev_name, const char __user *dir_name,
> -	       const char __user *type, unsigned long flags, void __user *data);
>  int ksys_umount(char __user *name, int flags);
>  int ksys_dup(unsigned int fildes);
>  int ksys_chroot(const char __user *filename);
> diff --git a/init/do_mounts.c b/init/do_mounts.c
> index 43f6d098c880..f55cbd9cb818 100644
> --- a/init/do_mounts.c
> +++ b/init/do_mounts.c
> @@ -387,12 +387,25 @@ static void __init get_fs_names(char *page)
>  	*s = '\0';
>  }
>  
> -static int __init do_mount_root(char *name, char *fs, int flags, void *data)
> +static int __init do_mount_root(const char *name, const char *fs,
> +				 const int flags, const void *data)
>  {
>  	struct super_block *s;
> -	int err = ksys_mount(name, "/root", fs, flags, data);
> -	if (err)
> -		return err;
> +	char *data_page;
> +	struct page *p;
> +	int ret;
> +
> +	/* do_mount() requires a full page as fifth argument */
> +	p = alloc_page(GFP_KERNEL);
> +	if (!p)
> +		return -ENOMEM;
> +
> +	data_page = page_address(p);
> +	strncpy(data_page, data, PAGE_SIZE - 1);

I tried 5.2-rc2 and I get kernel OOPS/panic here (do_mount_root gets inlined
into mount_block_root):

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x96000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000005
  CM = 0, WnR = 0
[0000000000000000] user address but active_mm is swapper
Internal error: Oops: 96000005 [#1] SMP
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.5.0-rc2-00128-ge93c94cc04ae #5
Hardware name: OrangePi 3 (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO)
pc : strncpy+0x10/0x30
lr : do_mount_root+0x70/0x114
sp : ffffffc01002bd20
x29: ffffffc01002bd20 x28: 0000000000000000
x27: 0000000000000000 x26: ffffffc011400468
x25: ffffffc0110d23a0 x24: ffffffff01c396c0
x23: 0000000000008000 x22: ffffff8078e5b000
x21: ffffffc0110d23a0 x20: ffffffc0110d2220
x19: ffffffff01c39700 x18: 00000000fffffffe
x17: 00000000dbaba8be x16: 0000000000000000
x15: ffffffffffffffff x14: ffffff0000000000
x13: ffffff807b490000 x12: 0000000000000000
x11: 0000000000000000 x10: ffffff807bb96120
x9 : 0000000000000000 x8 : 0000000000000000
x7 : ffffffc06a6e6000 x6 : 0000000000000000
x5 : 000000000003b820 x4 : ffffff8078e5cfff
x3 : 0000000000000201 x2 : ffffff8078e5c000
x1 : 0000000000000000 x0 : ffffff8078e5c000
Call trace:
 strncpy+0x10/0x30
 mount_block_root+0x100/0x224
 mount_root+0x10c/0x124
 prepare_namespace+0x12c/0x168
 kernel_init_freeable+0x214/0x258
 kernel_init+0x10/0xfc
 ret_from_fork+0x10/0x1c
Code: b4000142 8b020004 aa0003e2 d503201f (39400023)
---[ end trace b72d58d1ea940426 ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x00002,20002000
Memory Limit: none
Rebooting in 3 seconds..

regards,
	o.

> +	ret = do_mount(name, "/root", fs, flags, data_page);
> +	if (ret)
> +		goto out;
>  
>  	ksys_chdir("/root");
>  	s = current->fs->pwd.dentry->d_sb;
> @@ -402,7 +415,10 @@ static int __init do_mount_root(char *name, char *fs, int flags, void *data)
>  	       s->s_type->name,
>  	       sb_rdonly(s) ? " readonly" : "",
>  	       MAJOR(ROOT_DEV), MINOR(ROOT_DEV));
> -	return 0;
> +
> +out:
> +	put_page(p);
> +	return ret;
>  }
>  
>  void __init mount_block_root(char *name, int flags)
> @@ -671,7 +687,7 @@ void __init prepare_namespace(void)
>  	mount_root();
>  out:
>  	devtmpfs_mount();
> -	ksys_mount(".", "/", NULL, MS_MOVE, NULL);
> +	do_mount(".", "/", NULL, MS_MOVE, NULL);
>  	ksys_chroot(".");
>  }
>  
> -- 
> 2.24.1
>