Messages in this thread Patch in this message | | | From | Andrey Konovalov <> | Subject | [PATCH v5 07/10] fs, arm64: untag user address in copy_mount_options | Date | Mon, 6 Aug 2018 18:40:42 +0200 |
| |
In copy_mount_options a user address is being subtracted from TASK_SIZE. If the address is lower than TASK_SIZE, the size is calculated to not allow the exact_copy_from_user() call to cross TASK_SIZE boundary. However if the address is tagged, then the size will be calculated incorrectly.
Untag the address before subtracting.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/namespace.c b/fs/namespace.c index 8ddd14806799..fd070e65e529 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2733,7 +2733,7 @@ void *copy_mount_options(const void __user * data) * the remainder of the page. */ /* copy_from_user cannot cross TASK_SIZE ! */ - size = TASK_SIZE - (unsigned long)data; + size = TASK_SIZE - (unsigned long)untagged_addr(data); if (size > PAGE_SIZE) size = PAGE_SIZE; -- 2.18.0.597.ga71716f1ad-goog
| |