linux-kernel - Re: [PATCH v4 2/5] connector: use __get_task_comm in proc_comm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211013101921.0843aaf0@gandalf.local.home>
Date:   Wed, 13 Oct 2021 10:19:21 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Yafang Shao <laoar.shao@...il.com>
Cc:     keescook@...omium.org, peterz@...radead.org, pmladek@...e.com,
        viro@...iv.linux.org.uk, akpm@...ux-foundation.org,
        valentin.schneider@....com, mathieu.desnoyers@...icios.com,
        qiang.zhang@...driver.com, robdclark@...omium.org,
        christian@...uner.io, dietmar.eggemann@....com, mingo@...hat.com,
        juri.lelli@...hat.com, vincent.guittot@...aro.org,
        bsegall@...gle.com, mgorman@...e.de, bristot@...hat.com,
        davem@...emloft.net, kuba@...nel.org, linux-kernel@...r.kernel.org,
        Vladimir Zapolskiy <vzapolskiy@...il.com>,
        David Howells <dhowells@...hat.com>
Subject: Re: [PATCH v4 2/5] connector: use __get_task_comm in
 proc_comm_connector

On Wed, 13 Oct 2021 10:23:43 +0000
Yafang Shao <laoar.shao@...il.com> wrote:

> --- a/drivers/connector/cn_proc.c
> +++ b/drivers/connector/cn_proc.c
> @@ -230,7 +230,10 @@ void proc_comm_connector(struct task_struct *task)
>  	ev->what = PROC_EVENT_COMM;
>  	ev->event_data.comm.process_pid  = task->pid;
>  	ev->event_data.comm.process_tgid = task->tgid;
> -	get_task_comm(ev->event_data.comm.comm, task);
> +
> +	/* This may get truncated. */
> +	__get_task_comm(ev->event_data.comm.comm,
> +			sizeof(ev->event_data.comm.comm), task);
>  
>  	memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
>  	msg->ack = 0; /* not used */

__get_task_comm() uses strncpy() which my understanding is, does not add
the nul terminating byte when truncating. Which changes the functionality
here. As all task comms have a terminating byte, the old method would copy
that and include it. This won't add the terminating byte if the buffer is
smaller than the comm, and that might cause issues.

-- Steve