2015-11-10 18:38:40

by Badhri Jagan Sridharan

Subject: init: How did init/do_mounts_rd.c overcome memory protection ?

Mighty upstream,

I see that do_mounts_rd.c seems to make calls to sys_read and
sys_lseek functions. As these are syscall functions, they expects
some of the arguments to be from userspace.

I was going through the article that Greg KH wrote a while back:
http://www.linuxjournal.com/article/8110?page=0,1 . I don't see any
references to set_fs/get_fs under init/*. Does the memory protection
get enabled only in the later stage ? Or does do_mounts_rd.c accomplish
this in some other way ?

Thanks,
Badhri

2015-11-10 21:37:12

by Richard Weinberger

Subject: Re: init: How did init/do_mounts_rd.c overcome memory protection ?

On Tue, Nov 10, 2015 at 7:38 PM, Badhri Jagan Sridharan
<[email protected]> wrote:
> Mighty upstream,
>
> I see that do_mounts_rd.c seems to make calls to sys_read and
> sys_lseek functions. As these are syscall functions, they expects
> some of the arguments to be from userspace.
>
> I was going through the article that Greg KH wrote a while back:
> http://www.linuxjournal.com/article/8110?page=0,1 . I don't see any
> references to set_fs/get_fs under init/*. Does the memory protection
> get enabled only in the later stage ? Or does do_mounts_rd.c accomplish
> this in some other way ?

The stuff in init/ is PID 1 and it inherits addr_limit from the
initial thread (PID 0 or swapper called).
INIT_THREAD_INFO() sets addr_limit to KERNEL_DS.

--
Thanks,
//richard

2015-11-11 01:22:32

by Badhri Jagan Sridharan

Subject: Re: init: How did init/do_mounts_rd.c overcome memory protection ?

Thanks Richard !!
That's the one that I was looking for.

On Tue, Nov 10, 2015 at 1:37 PM, Richard Weinberger
<[email protected]> wrote:
> On Tue, Nov 10, 2015 at 7:38 PM, Badhri Jagan Sridharan
> <[email protected]> wrote:
>> Mighty upstream,
>>
>> I see that do_mounts_rd.c seems to make calls to sys_read and
>> sys_lseek functions. As these are syscall functions, they expects
>> some of the arguments to be from userspace.
>>
>> I was going through the article that Greg KH wrote a while back:
>> http://www.linuxjournal.com/article/8110?page=0,1 . I don't see any
>> references to set_fs/get_fs under init/*. Does the memory protection
>> get enabled only in the later stage ? Or does do_mounts_rd.c accomplish
>> this in some other way ?
>
> The stuff in init/ is PID 1 and it inherits addr_limit from the
> initial thread (PID 0 or swapper called).
> INIT_THREAD_INFO() sets addr_limit to KERNEL_DS.
>
> --
> Thanks,
> //richard