path: root/fs
diff options
authorAndrey Konovalov <>2019-09-25 16:48:40 -0700
committerLinus Torvalds <>2019-09-25 17:51:41 -0700
commited8a66b83269c27f7181c95b477da5d33fecfbc4 (patch)
treedefe501bd6d690e9385516b474a64c1477865a8e /fs
parent5d65e7a7d8cd5c77baa1acf129a11b8b45ffee75 (diff)
fs/namespace: untag user pointers in copy_mount_options
This patch is a part of a series that extends kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments. In copy_mount_options a user address is being subtracted from TASK_SIZE. If the address is lower than TASK_SIZE, the size is calculated to not allow the exact_copy_from_user() call to cross TASK_SIZE boundary. However if the address is tagged, then the size will be calculated incorrectly. Untag the address before subtracting. Link: Signed-off-by: Andrey Konovalov <> Reviewed-by: Khalid Aziz <> Reviewed-by: Vincenzo Frascino <> Reviewed-by: Kees Cook <> Reviewed-by: Catalin Marinas <> Cc: Al Viro <> Cc: Dave Hansen <> Cc: Eric Auger <> Cc: Felix Kuehling <> Cc: Jens Wiklander <> Cc: Mauro Carvalho Chehab <> Cc: Mike Rapoport <> Cc: Will Deacon <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
Diffstat (limited to 'fs')
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/namespace.c b/fs/namespace.c
index 93c043245c46..abcdc5f44865 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3028,7 +3028,7 @@ void *copy_mount_options(const void __user * data)
* the remainder of the page.
/* copy_from_user cannot cross TASK_SIZE ! */
- size = TASK_SIZE - (unsigned long)data;
+ size = TASK_SIZE - (unsigned long)untagged_addr(data);
if (size > PAGE_SIZE)
size = PAGE_SIZE;