fs: Handle intra-page faults in copy_mount_options()

The copy_mount_options() function takes a user pointer argument but no
size and it tries to read up to a PAGE_SIZE. However, copy_from_user()
is not guaranteed to return all the accessible bytes if, for example,
the access crosses a page boundary and gets a fault on the second page.
To work around this, the current copy_mount_options() implementation
performs two copy_from_user() passes, first to the end of the current
page and the second to what's left in the subsequent page.

On arm64 with MTE enabled, access to a user page may trigger a fault
after part of the buffer in a page has been copied (when the user
pointer tag, bits 56-59, no longer matches the allocation tag stored in
memory). Allow copy_mount_options() to handle such intra-page faults by
resorting to byte at a time copy in case of copy_from_user() failure.

Note that copy_from_user() handles the zeroing of the kernel buffer in
case of error.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/namespace.c b/fs/namespace.c
index bae0e95..32a0b91 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3075,7 +3075,7 @@ static void shrink_submounts(struct mount *mnt)
 void *copy_mount_options(const void __user * data)
 {
        char *copy;
-       unsigned size;
+       unsigned left, offset;
 
        if (!data)
                return NULL;
@@ -3084,16 +3084,27 @@ void *copy_mount_options(const void __user * data)
        if (!copy)
                return ERR_PTR(-ENOMEM);
 
-       size = PAGE_SIZE - offset_in_page(data);
+       left = copy_from_user(copy, data, PAGE_SIZE);
 
-       if (copy_from_user(copy, data, size)) {
+       /*
+        * Not all architectures have an exact copy_from_user(). Resort to
+        * byte at a time.
+        */
+       offset = PAGE_SIZE - left;
+       while (left) {
+               char c;
+               if (get_user(c, (const char __user *)data + offset))
+                       break;
+               copy[offset] = c;
+               left--;
+               offset++;
+       }
+
+       if (left == PAGE_SIZE) {
                kfree(copy);
                return ERR_PTR(-EFAULT);
        }
-       if (size != PAGE_SIZE) {
-               if (copy_from_user(copy + size, data + size, PAGE_SIZE - size))
-                       memset(copy + size, 0, PAGE_SIZE - size);
-       }
+
        return copy;
 }