linux-kernel - [PATCH RFC 1/2] exec: Dynamically allocate memory to store task's full name

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250314052715.610377-2-bhupesh@igalia.com>
Date: Fri, 14 Mar 2025 10:57:14 +0530
From: Bhupesh <bhupesh@...lia.com>
To: akpm@...ux-foundation.org
Cc: bhupesh@...lia.com,
	kernel-dev@...lia.com,
	linux-kernel@...r.kernel.org,
	bpf@...r.kernel.org,
	linux-perf-users@...r.kernel.org,
	linux-fsdevel@...r.kernel.org,
	linux-mm@...ck.org,
	oliver.sang@...el.com,
	lkp@...el.com,
	laoar.shao@...il.com,
	pmladek@...e.com,
	rostedt@...dmis.org,
	mathieu.desnoyers@...icios.com,
	arnaldo.melo@...il.com,
	alexei.starovoitov@...il.com,
	andrii.nakryiko@...il.com,
	mirq-linux@...e.qmqm.pl,
	peterz@...radead.org,
	willy@...radead.org,
	david@...hat.com,
	viro@...iv.linux.org.uk,
	keescook@...omium.org,
	ebiederm@...ssion.com,
	brauner@...nel.org,
	jack@...e.cz,
	mingo@...hat.com,
	juri.lelli@...hat.com,
	bsegall@...gle.com,
	mgorman@...e.de,
	vschneid@...hat.com
Subject: [PATCH RFC 1/2] exec: Dynamically allocate memory to store task's full name

Provide a parallel implementation for get_task_comm() called
get_task_full_name() which allows the dynamically allocated
and filled-in task's full name to be passed to interested
users such as 'ps'.

Currently while running 'ps', the 'task->comm' value of a long
task name is truncated due to the limitation of TASK_COMM_LEN.
For example:
  # ./create_very_long_name_user_space_script.sh&
  # ps
    PID TTY          TIME CMD
    332 ttyAMA0  00:00:00 create_very_lon

This leads to the names passed from userland via 'pthread_setname_np()'
being truncated.

Now, during debug tracing, seeing truncated names is not very useful.
(for example for debug applications invoking 'pthread_getname_np()') to
debug task names.

One possible way to fix this issue is extending the task comm size, but
as 'task->comm' is used in lots of places, that may cause some potential
buffer overflows. Another more conservative approach is introducing a new
pointer to store task's full name, which won't introduce too much overhead
as it is in the non-critical path.

After this change, the full name of these truncated tasks will be shown
in 'ps'. For example:
  # ps
    PID TTY          TIME CMD
    305 ttyAMA0  00:00:00 create_very_long_name_user_space_script.sh

Here is the proposed flow now:
 1. 'pthread_setname_np()' like userspace API sets thread name.
 2. This will set 'task->full_name' in addition to default 16-byte
   truncated 'task->comm'.
 3. And 'pthread_getname_np()' will retrieve 'task->full_name' by
   default from the same '/proc/self/task/[tid]/full_name'

Step 3 implementation is achieved via the subsequent patch in this
patchset.

Signed-off-by: Bhupesh <bhupesh@...lia.com>
---
 fs/exec.c             | 21 ++++++++++++++++++---
 include/linux/sched.h |  9 +++++++++
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 506cd411f4ac2..43d0a0d81d44e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1210,6 +1210,9 @@ int begin_new_exec(struct linux_binprm * bprm)
 {
 	struct task_struct *me = current;
 	int retval;
+	va_list args;
+	char *name;
+	const char *fmt;
 
 	/* Once we are committed compute the creds */
 	retval = bprm_creds_from_file(bprm);
@@ -1350,11 +1353,22 @@ int begin_new_exec(struct linux_binprm * bprm)
 		 * detecting a concurrent rename and just want a terminated name.
 		 */
 		rcu_read_lock();
-		__set_task_comm(me, smp_load_acquire(&bprm->file->f_path.dentry->d_name.name),
-				true);
+		fmt = smp_load_acquire(&bprm->file->f_path.dentry->d_name.name);
+		name = kvasprintf(GFP_KERNEL, fmt, args);
+		if (!name)
+			return -ENOMEM;
+
+		me->full_name = name;
+		__set_task_comm(me, fmt, true);
 		rcu_read_unlock();
 	} else {
-		__set_task_comm(me, kbasename(bprm->filename), true);
+		fmt = kbasename(bprm->filename);
+		name = kvasprintf(GFP_KERNEL, fmt, args);
+		if (!name)
+			return -ENOMEM;
+
+		me->full_name = name;
+		__set_task_comm(me, fmt, true);
 	}
 
 	/* An exec changes our domain. We are no longer part of the thread
@@ -1401,6 +1415,7 @@ int begin_new_exec(struct linux_binprm * bprm)
 	return 0;
 
 out_unlock:
+	kfree(me->full_name);
 	up_write(&me->signal->exec_update_lock);
 	if (!bprm->cred)
 		mutex_unlock(&me->signal->cred_guard_mutex);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 9c15365a30c08..ebf121768d951 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1144,6 +1144,9 @@ struct task_struct {
 	 */
 	char				comm[TASK_COMM_LEN];
 
+	/* To store the full name if task comm is truncated. */
+	char				*full_name;
+
 	struct nameidata		*nameidata;
 
 #ifdef CONFIG_SYSVIPC
@@ -1984,6 +1987,12 @@ extern void __set_task_comm(struct task_struct *tsk, const char *from, bool exec
 	buf;						\
 })
 
+#define get_task_full_name(buf, buf_size, tsk) ({	\
+	BUILD_BUG_ON(sizeof(buf) < TASK_COMM_LEN);	\
+	strscpy_pad(buf, (tsk)->full_name, buf_size);	\
+	buf;						\
+})
+
 #ifdef CONFIG_SMP
 static __always_inline void scheduler_ipi(void)
 {
-- 
2.38.1