Re: [PATCH 3/3] init: use do_mount() instead of ksys_mount()

[Geert Uytterhoeven]

Hi all,

On Mon, Dec 16, 2019 at 6:13 AM Eric Biggers <ebiggers@xxxxxxxxxx> wrote:
> On Sun, Dec 15, 2019 at 07:50:23PM -0800, Linus Torvalds wrote:
> > On Sun, Dec 15, 2019 at 5:35 PM OndÅej Jirman <megi@xxxxxx> wrote:
> > > Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> >
> > Duh. So much for the trivial obvious conversion.
> >
> > It didn't take "data might be NULL" into account.
> >
> > A patch like this, perhaps? Untested..

> > --- a/init/do_mounts.c
> > +++ b/init/do_mounts.c
> > @@ -391,17 +391,19 @@ static int __init do_mount_root(const char *name, const char *fs,
> >                                const int flags, const void *data)
> >  {
> >       struct super_block *s;
> > -     char *data_page;
> > -     struct page *p;
> > +     struct page *p = NULL;
> > +     char *data_page = NULL;
> >       int ret;
> >
> > -     /* do_mount() requires a full page as fifth argument */
> > -     p = alloc_page(GFP_KERNEL);
> > -     if (!p)
> > -             return -ENOMEM;
> > -
> > -     data_page = page_address(p);
> > -     strncpy(data_page, data, PAGE_SIZE - 1);
> > +     if (data) {
> > +             /* do_mount() requires a full page as fifth argument */
> > +             p = alloc_page(GFP_KERNEL);
> > +             if (!p)
> > +                     return -ENOMEM;
> > +             data_page = page_address(p);
> > +             strncpy(data_page, data, PAGE_SIZE - 1);
> > +             data_page[PAGE_SIZE - 1] = '\0';
> > +     }
> >
> >       ret = do_mount(name, "/root", fs, flags, data_page);
> >       if (ret)
> > @@ -417,7 +419,8 @@ static int __init do_mount_root(const char *name, const char *fs,
> >              MAJOR(ROOT_DEV), MINOR(ROOT_DEV));
> >
> >  out:
> > -     put_page(p);
> > +     if (p)
> > +             put_page(p);
> >       return ret;
>
> I'm seeing the boot crash too, and Linus' patch fixes it.

#metoo ;-)

Tested-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>

> Note that adding the line
>
>                 data_page[PAGE_SIZE - 1] = '\0';
>
> is not necessary since do_mount() already does it.

Indeed. So the "-1" can be dropped from the strncpy() call, which brings
it even more in-line with the "full page" comment.

Gr{oetje,eeting}s,

                        Geert


--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds