| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20191216013536.5wyvq4vjv5efd35n@core.my.home>
Date: Mon, 16 Dec 2019 02:35:36 +0100
From: Ondřej Jirman <megi@....cz>
To: Dominik Brodowski <linux@...inikbrodowski.net>
Cc: Alexander Viro <viro@...iv.linux.org.uk>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
"Rafael J . Wysocki" <rafael@...nel.org>,
Andrew Morton <akpm@...ux-foundation.org>,
Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/3] init: use do_mount() instead of ksys_mount()
Hello,
On Thu, Dec 12, 2019 at 02:57:24PM +0100, Dominik Brodowski wrote:
> In prepare_namespace(), do_mount() can be used instead of ksys_mount()
> as the first and third argument are const strings in the kernel, the
> second and fourth argument are passed through anyway, and the fifth
> argument is NULL.
>
> In do_mount_root(), ksys_mount() is called with the first and third
> argument being already kernelspace strings, which do not need to be
> copied over from userspace to kernelspace (again). The second and
> fourth arguments are passed through to do_mount() anyway. The fifth
> argument, while already residing in kernelspace, needs to be put into
> a page of its own. Then, do_mount() can be used instead of
> ksys_mount().
>
> Once this is done, there are no in-kernel users to ksys_mount() left,
> which can therefore be removed.
>
> Signed-off-by: Dominik Brodowski <linux@...inikbrodowski.net>
> ---
> fs/namespace.c | 10 ++--------
> include/linux/syscalls.h | 2 --
> init/do_mounts.c | 28 ++++++++++++++++++++++------
> 3 files changed, 24 insertions(+), 16 deletions(-)
>
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 2fd0c8bcb8c1..be601d3a8008 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -3325,8 +3325,8 @@ struct dentry *mount_subtree(struct vfsmount *m, const char *name)
> }
> EXPORT_SYMBOL(mount_subtree);
>
> -int ksys_mount(const char __user *dev_name, const char __user *dir_name,
> - const char __user *type, unsigned long flags, void __user *data)
> +SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
> + char __user *, type, unsigned long, flags, void __user *, data)
> {
> int ret;
> char *kernel_type;
> @@ -3359,12 +3359,6 @@ int ksys_mount(const char __user *dev_name, const char __user *dir_name,
> return ret;
> }
>
> -SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
> - char __user *, type, unsigned long, flags, void __user *, data)
> -{
> - return ksys_mount(dev_name, dir_name, type, flags, data);
> -}
> -
> /*
> * Create a kernel mount representation for a new, prepared superblock
> * (specified by fs_fd) and attach to an open_tree-like file descriptor.
> diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
> index d0391cc2dae9..5262b7a76d39 100644
> --- a/include/linux/syscalls.h
> +++ b/include/linux/syscalls.h
> @@ -1231,8 +1231,6 @@ asmlinkage long sys_ni_syscall(void);
> * the ksys_xyzyyz() functions prototyped below.
> */
>
> -int ksys_mount(const char __user *dev_name, const char __user *dir_name,
> - const char __user *type, unsigned long flags, void __user *data);
> int ksys_umount(char __user *name, int flags);
> int ksys_dup(unsigned int fildes);
> int ksys_chroot(const char __user *filename);
> diff --git a/init/do_mounts.c b/init/do_mounts.c
> index 43f6d098c880..f55cbd9cb818 100644
> --- a/init/do_mounts.c
> +++ b/init/do_mounts.c
> @@ -387,12 +387,25 @@ static void __init get_fs_names(char *page)
> *s = '\0';
> }
>
> -static int __init do_mount_root(char *name, char *fs, int flags, void *data)
> +static int __init do_mount_root(const char *name, const char *fs,
> + const int flags, const void *data)
> {
> struct super_block *s;
> - int err = ksys_mount(name, "/root", fs, flags, data);
> - if (err)
> - return err;
> + char *data_page;
> + struct page *p;
> + int ret;
> +
> + /* do_mount() requires a full page as fifth argument */
> + p = alloc_page(GFP_KERNEL);
> + if (!p)
> + return -ENOMEM;
> +
> + data_page = page_address(p);
> + strncpy(data_page, data, PAGE_SIZE - 1);
I tried 5.2-rc2 and I get kernel OOPS/panic here (do_mount_root gets inlined
into mount_block_root):
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x96000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000005
CM = 0, WnR = 0
[0000000000000000] user address but active_mm is swapper
Internal error: Oops: 96000005 [#1] SMP
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.5.0-rc2-00128-ge93c94cc04ae #5
Hardware name: OrangePi 3 (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO)
pc : strncpy+0x10/0x30
lr : do_mount_root+0x70/0x114
sp : ffffffc01002bd20
x29: ffffffc01002bd20 x28: 0000000000000000
x27: 0000000000000000 x26: ffffffc011400468
x25: ffffffc0110d23a0 x24: ffffffff01c396c0
x23: 0000000000008000 x22: ffffff8078e5b000
x21: ffffffc0110d23a0 x20: ffffffc0110d2220
x19: ffffffff01c39700 x18: 00000000fffffffe
x17: 00000000dbaba8be x16: 0000000000000000
x15: ffffffffffffffff x14: ffffff0000000000
x13: ffffff807b490000 x12: 0000000000000000
x11: 0000000000000000 x10: ffffff807bb96120
x9 : 0000000000000000 x8 : 0000000000000000
x7 : ffffffc06a6e6000 x6 : 0000000000000000
x5 : 000000000003b820 x4 : ffffff8078e5cfff
x3 : 0000000000000201 x2 : ffffff8078e5c000
x1 : 0000000000000000 x0 : ffffff8078e5c000
Call trace:
strncpy+0x10/0x30
mount_block_root+0x100/0x224
mount_root+0x10c/0x124
prepare_namespace+0x12c/0x168
kernel_init_freeable+0x214/0x258
kernel_init+0x10/0xfc
ret_from_fork+0x10/0x1c
Code: b4000142 8b020004 aa0003e2 d503201f (39400023)
---[ end trace b72d58d1ea940426 ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x00002,20002000
Memory Limit: none
Rebooting in 3 seconds..
regards,
o.
> + ret = do_mount(name, "/root", fs, flags, data_page);
> + if (ret)
> + goto out;
>
> ksys_chdir("/root");
> s = current->fs->pwd.dentry->d_sb;
> @@ -402,7 +415,10 @@ static int __init do_mount_root(char *name, char *fs, int flags, void *data)
> s->s_type->name,
> sb_rdonly(s) ? " readonly" : "",
> MAJOR(ROOT_DEV), MINOR(ROOT_DEV));
> - return 0;
> +
> +out:
> + put_page(p);
> + return ret;
> }
>
> void __init mount_block_root(char *name, int flags)
> @@ -671,7 +687,7 @@ void __init prepare_namespace(void)
> mount_root();
> out:
> devtmpfs_mount();
> - ksys_mount(".", "/", NULL, MS_MOVE, NULL);
> + do_mount(".", "/", NULL, MS_MOVE, NULL);
> ksys_chroot(".");
> }
>
> --
> 2.24.1
>
Powered by blists - more mailing lists