diff options
author | Jeff Layton <jlayton@redhat.com> | 2012-10-10 15:25:26 -0400 |
---|---|---|
committer | Al Viro <viro@zeniv.linux.org.uk> | 2012-10-12 00:32:03 -0400 |
commit | a608ca21f58ee44df5a71ba140e98498f3ebc2cd (patch) | |
tree | 4ba6f5d5414ba9b579c8e41eb30c21a709537922 /init | |
parent | 4fa6b5ecbf092c6ee752ece8a55d71f663d23254 (diff) |
vfs: allocate page instead of names_cache buffer in mount_block_root
First, it's incorrect to call putname() after __getname_gfp() since the
bare __getname_gfp() call skips the auditing code, while putname()
doesn't.
mount_block_root allocates a PATH_MAX buffer via __getname_gfp, and then
calls get_fs_names to fill the buffer. That function can call
get_filesystem_list which assumes that that buffer is a full page in
size. On arches where PAGE_SIZE != 4k, then this could potentially
overrun.
In practice, it's hard to imagine the list of filesystem names even
approaching 4k, but it's best to be safe. Just allocate a page for this
purpose instead.
With this, we can also remove the __getname_gfp() definition since there
are no more callers.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'init')
-rw-r--r-- | init/do_mounts.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/init/do_mounts.c b/init/do_mounts.c index d3f0aeed2d39..f8a66424360d 100644 --- a/init/do_mounts.c +++ b/init/do_mounts.c | |||
@@ -353,8 +353,9 @@ static int __init do_mount_root(char *name, char *fs, int flags, void *data) | |||
353 | 353 | ||
354 | void __init mount_block_root(char *name, int flags) | 354 | void __init mount_block_root(char *name, int flags) |
355 | { | 355 | { |
356 | char *fs_names = __getname_gfp(GFP_KERNEL | 356 | struct page *page = alloc_page(GFP_KERNEL | |
357 | | __GFP_NOTRACK_FALSE_POSITIVE); | 357 | __GFP_NOTRACK_FALSE_POSITIVE); |
358 | char *fs_names = page_address(page); | ||
358 | char *p; | 359 | char *p; |
359 | #ifdef CONFIG_BLOCK | 360 | #ifdef CONFIG_BLOCK |
360 | char b[BDEVNAME_SIZE]; | 361 | char b[BDEVNAME_SIZE]; |
@@ -406,7 +407,7 @@ retry: | |||
406 | #endif | 407 | #endif |
407 | panic("VFS: Unable to mount root fs on %s", b); | 408 | panic("VFS: Unable to mount root fs on %s", b); |
408 | out: | 409 | out: |
409 | putname(fs_names); | 410 | put_page(page); |
410 | } | 411 | } |
411 | 412 | ||
412 | #ifdef CONFIG_ROOT_NFS | 413 | #ifdef CONFIG_ROOT_NFS |