linux-kernel - Re: [PATCH 1/5] kernel: replace sizeof(task->comm) with TASK_COMM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALOAHbB6Ko0szbA0znsxcyfMFdScVUqOA1_dokzJRAvQ41n5zg@mail.gmail.com>
Date:   Sun, 3 Oct 2021 22:14:29 +0800
From:   Yafang Shao <laoar.shao@...il.com>
To:     Al Viro <viro@...iv.linux.org.uk>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Petr Mladek <pmladek@...e.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Valentin Schneider <valentin.schneider@....com>,
        Kees Cook <keescook@...omium.org>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        qiang.zhang@...driver.com, robdclark@...omium.org,
        christian@...uner.io, Dietmar Eggemann <dietmar.eggemann@....com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/5] kernel: replace sizeof(task->comm) with TASK_COMM_LEN

On Sun, Oct 3, 2021 at 11:31 AM Al Viro <viro@...iv.linux.org.uk> wrote:
>
> On Wed, Sep 29, 2021 at 11:50:32AM +0000, Yafang Shao wrote:
>
> > --- a/kernel/sys.c
> > +++ b/kernel/sys.c
> > @@ -2265,7 +2265,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
> >               unsigned long, arg4, unsigned long, arg5)
> >  {
> >       struct task_struct *me = current;
> > -     unsigned char comm[sizeof(me->comm)];
> > +     unsigned char comm[TASK_COMM_LEN];
> >       long error;
> >
> >       error = security_task_prctl(option, arg2, arg3, arg4, arg5);
>
> Slightly below you have this:
>         case PR_SET_NAME:
>                 comm[sizeof(me->comm) - 1] = 0;
>                 if (strncpy_from_user(comm, (char __user *)arg2,
>                                       sizeof(me->comm) - 1) < 0)
>                         return -EFAULT;
>                 set_task_comm(me, comm);
>                 proc_comm_connector(me);
>                 break;
>
> How had that been tested?

Thanks for pointing out this. Honestly speaking I didn't test  PR_SET_NAME.
It is strange that I missed these two me->comm.
I have grepped all "->comm"  in the kernel and checked one by one, so
these two should be found...

-- 
Thanks
Yafang