Ttyjfyk

Melting point of aspirin, contradicting sources

How do you respond to a colleague from another team when they're wrongly expecting that you'll help them?

What major Native American tribes were around Santa Fe during the late 1850s?

Could the E-bike drivetrain wear down till needing replacement after 400 km?

Query about absorption line spectra

Can not upgrade Kali,not enough space in /var/cache/apt/archives

Difference between -| and |- in TikZ

Does a 'pending' US visa application constitute a denial?

How is flyblackbird.com operating under Part 91K?

What linear sensor for a keyboard?

anything or something to eat

Have I saved too much for retirement so far?

Is there a name for this algorithm to calculate the concentration of a mixture of two solutions containing the same solute?

Can the Supreme Court overturn an impeachment?

What is the difference between "Do you interest" and "...interested in" something?

How much character growth crosses the line into breaking the character

Flux received by a negative charge

Question about alert, surprise, and crit failing

Python script not running correctly when launched with crontab

Why do IPv6 unique local addresses have to have a /48 prefix?

Engineer refusing to file/disclose patents

Indicating multiple different modes of speech (fantasy language or telepathy)

getting the weights of intermediate layer in keras

Offered money to buy a house, seller is asking for more to cover gap between their listing and mortgage owed

I found kernel code that makes system calls. But I thought that was not allowed?

0

Context: linux-5.0/Documentation/process/adding-syscalls.rst#do-not-call-system-calls-in-the-kernel

Firstly, kernel code cannot call functions like "sys_xyzzy()" anymore, because they have the wrong calling convention.

But secondly, "rules on how data may be accessed may differ between kernel data and user data."

There are now some functions which are direct replacements for the old "sys_xyzzy()" calls. For example: ksys_mount().

ksys_mount() takes pointers to __user memory, just like calls to sys_mount() did. Therefore it should fail if you pass it a pointer to kernel memory. Specifically, it will fail when it calls copy_from_user(), unless you play games with set_fs().

So... why do we have a couple of calls to ksys_mount() in various places inside the kernel? How can these possibly work? They are not wrapped with calls to set_fs().

https://elixir.bootlin.com/linux/v5.0/ident/ksys_mount

• drivers/base/devtmpfs.c


• init/do_mounts.c


• ...

linux-kernel

share|improve this question

edited Mar 15 at 21:24

sourcejedi

asked Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

add a comment | 

0

Context: linux-5.0/Documentation/process/adding-syscalls.rst#do-not-call-system-calls-in-the-kernel

Firstly, kernel code cannot call functions like "sys_xyzzy()" anymore, because they have the wrong calling convention.

But secondly, "rules on how data may be accessed may differ between kernel data and user data."

There are now some functions which are direct replacements for the old "sys_xyzzy()" calls. For example: ksys_mount().

ksys_mount() takes pointers to __user memory, just like calls to sys_mount() did. Therefore it should fail if you pass it a pointer to kernel memory. Specifically, it will fail when it calls copy_from_user(), unless you play games with set_fs().

So... why do we have a couple of calls to ksys_mount() in various places inside the kernel? How can these possibly work? They are not wrapped with calls to set_fs().

https://elixir.bootlin.com/linux/v5.0/ident/ksys_mount

• drivers/base/devtmpfs.c


• init/do_mounts.c


• ...

linux-kernel

share|improve this question

edited Mar 15 at 21:24

sourcejedi

asked Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

add a comment | 

Context: linux-5.0/Documentation/process/adding-syscalls.rst#do-not-call-system-calls-in-the-kernel

Firstly, kernel code cannot call functions like "sys_xyzzy()" anymore, because they have the wrong calling convention.

But secondly, "rules on how data may be accessed may differ between kernel data and user data."

There are now some functions which are direct replacements for the old "sys_xyzzy()" calls. For example: ksys_mount().

ksys_mount() takes pointers to __user memory, just like calls to sys_mount() did. Therefore it should fail if you pass it a pointer to kernel memory. Specifically, it will fail when it calls copy_from_user(), unless you play games with set_fs().

So... why do we have a couple of calls to ksys_mount() in various places inside the kernel? How can these possibly work? They are not wrapped with calls to set_fs().

https://elixir.bootlin.com/linux/v5.0/ident/ksys_mount

• drivers/base/devtmpfs.c


• init/do_mounts.c


• ...

linux-kernel

share|improve this question

edited Mar 15 at 21:24

sourcejedi

asked Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

share|improve this question

edited Mar 15 at 21:24

sourcejedi

asked Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

share|improve this question

edited Mar 15 at 21:24

sourcejedi

asked Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

asked Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

asked Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

1 Answer
1

active

oldest

votes

1

devtmpfs currently runs in a kernel thread. In a kernel thread, addr_limit is effectively disabled. At least that's how this works for x86 - it is architecture-specific code.

init/do_mounts.c is similar. The kernel init process must start like a kernel thread, with addr_limit effectively disabled. Later, it calls do_execve() to start executing the userspace init program. The kernel makes sure to call "set_fs(USER_DS)", before executing the userspace program.

share|improve this answer

edited Mar 13 at 16:37

answered Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f506120%2fi-found-kernel-code-that-makes-system-calls-but-i-thought-that-was-not-allowed%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

1

devtmpfs currently runs in a kernel thread. In a kernel thread, addr_limit is effectively disabled. At least that's how this works for x86 - it is architecture-specific code.

init/do_mounts.c is similar. The kernel init process must start like a kernel thread, with addr_limit effectively disabled. Later, it calls do_execve() to start executing the userspace init program. The kernel makes sure to call "set_fs(USER_DS)", before executing the userspace program.

share|improve this answer

edited Mar 13 at 16:37

answered Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

add a comment | 

1

devtmpfs currently runs in a kernel thread. In a kernel thread, addr_limit is effectively disabled. At least that's how this works for x86 - it is architecture-specific code.

init/do_mounts.c is similar. The kernel init process must start like a kernel thread, with addr_limit effectively disabled. Later, it calls do_execve() to start executing the userspace init program. The kernel makes sure to call "set_fs(USER_DS)", before executing the userspace program.

share|improve this answer

edited Mar 13 at 16:37

answered Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

add a comment | 

devtmpfs currently runs in a kernel thread. In a kernel thread, addr_limit is effectively disabled. At least that's how this works for x86 - it is architecture-specific code.

init/do_mounts.c is similar. The kernel init process must start like a kernel thread, with addr_limit effectively disabled. Later, it calls do_execve() to start executing the userspace init program. The kernel makes sure to call "set_fs(USER_DS)", before executing the userspace program.

share|improve this answer

edited Mar 13 at 16:37

answered Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

share|improve this answer

edited Mar 13 at 16:37

answered Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

answered Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110

answered Mar 13 at 16:32

sourcejedisourcejedi

25.4k445110