linux-kernel - RE: Mount options may be silently discarded

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87bb66c2a7f94bd1ab768a8160e48e39@AcuMS.aculab.com>
Date:   Mon, 28 Sep 2020 14:36:21 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Dmitry Kasatkin' <dmitry.kasatkin@...il.com>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>
CC:     Al Viro <viro@...iv.linux.org.uk>,
        linux-security-module <linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: Mount options may be silently discarded

From: Dmitry Kasatkin
> Sent: 28 September 2020 15:03
> 
> "copy_mount_options" function came to my eyes.
> It splits copy into 2 pieces - over page boundaries.
> I wonder what is the real reason for doing this?
> Original comment was that we need exact bytes and some user memcpy
> functions  do not return correct number on page fault.
> 
> But how would all other cases work?
> 
> https://elixir.bootlin.com/linux/latest/source/fs/namespace.c#L3075
> 
> if (size != PAGE_SIZE) {
>        if (copy_from_user(copy + size, data + size, PAGE_SIZE - size))
>             memset(copy + size, 0, PAGE_SIZE - size);
> }
> 
> This looks like some options may be just discarded?
> What if it is an important security option?
> 
> Why it does not return EFAULT, but just memset?

The user doesn't supply the transfer length, the max size
is a page.
Since the copy can only start to fail on a page boundary
reading in two pieces is exactly the same as knowing the
address at which the transfer started to fail.

Since the actual mount options can be much smaller than
a page (and usually are) zero-filling is best.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)