| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202110251417.4D879366@keescook>
Date: Mon, 25 Oct 2021 14:18:42 -0700
From: Kees Cook <keescook@...omium.org>
To: Yafang Shao <laoar.shao@...il.com>
Cc: akpm@...ux-foundation.org, rostedt@...dmis.org,
mathieu.desnoyers@...icios.com, arnaldo.melo@...il.com,
pmladek@...e.com, peterz@...radead.org, viro@...iv.linux.org.uk,
valentin.schneider@....com, qiang.zhang@...driver.com,
robdclark@...omium.org, christian@...uner.io,
dietmar.eggemann@....com, mingo@...hat.com, juri.lelli@...hat.com,
vincent.guittot@...aro.org, davem@...emloft.net, kuba@...nel.org,
ast@...nel.org, daniel@...earbox.net, andrii@...nel.org,
kafai@...com, songliubraving@...com, yhs@...com,
john.fastabend@...il.com, kpsingh@...nel.org,
dennis.dalessandro@...nelisnetworks.com,
mike.marciniszyn@...nelisnetworks.com, dledford@...hat.com,
jgg@...pe.ca, linux-rdma@...r.kernel.org, netdev@...r.kernel.org,
bpf@...r.kernel.org, linux-perf-users@...r.kernel.org,
linux-fsdevel@...r.kernel.org, linux-mm@...ck.org,
linux-kernel@...r.kernel.org, oliver.sang@...el.com, lkp@...el.com,
Andrii Nakryiko <andrii.nakryiko@...il.com>
Subject: Re: [PATCH v6 05/12] elfcore: make prpsinfo always get a nul
terminated task comm
On Mon, Oct 25, 2021 at 08:33:08AM +0000, Yafang Shao wrote:
> kernel test robot reported a -Wstringop-truncation warning after I
> extend task comm from 16 to 24. Below is the detailed warning:
>
> fs/binfmt_elf.c: In function 'fill_psinfo.isra':
> >> fs/binfmt_elf.c:1575:9: warning: 'strncpy' output may be truncated copying 16 bytes from a string of length 23 [-Wstringop-truncation]
> 1575 | strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> This patch can fix this warning.
>
> Replacing strncpy() with strscpy_pad() can avoid this warning.
>
> This patch also replace the hard-coded 16 with TASK_COMM_LEN to make it
> more compatible with task comm size change.
>
> I also verfied if it still work well when I extend the comm size to 24.
> struct elf_prpsinfo is used to dump the task information in userspace
> coredump or kernel vmcore. Below is the verfication of vmcore,
>
> crash> ps
> PID PPID CPU TASK ST %MEM VSZ RSS COMM
> 0 0 0 ffffffff9d21a940 RU 0.0 0 0 [swapper/0]
> > 0 0 1 ffffa09e40f85e80 RU 0.0 0 0 [swapper/1]
> > 0 0 2 ffffa09e40f81f80 RU 0.0 0 0 [swapper/2]
> > 0 0 3 ffffa09e40f83f00 RU 0.0 0 0 [swapper/3]
> > 0 0 4 ffffa09e40f80000 RU 0.0 0 0 [swapper/4]
> > 0 0 5 ffffa09e40f89f80 RU 0.0 0 0 [swapper/5]
> 0 0 6 ffffa09e40f8bf00 RU 0.0 0 0 [swapper/6]
> > 0 0 7 ffffa09e40f88000 RU 0.0 0 0 [swapper/7]
> > 0 0 8 ffffa09e40f8de80 RU 0.0 0 0 [swapper/8]
> > 0 0 9 ffffa09e40f95e80 RU 0.0 0 0 [swapper/9]
> > 0 0 10 ffffa09e40f91f80 RU 0.0 0 0 [swapper/10]
> > 0 0 11 ffffa09e40f93f00 RU 0.0 0 0 [swapper/11]
> > 0 0 12 ffffa09e40f90000 RU 0.0 0 0 [swapper/12]
> > 0 0 13 ffffa09e40f9bf00 RU 0.0 0 0 [swapper/13]
> > 0 0 14 ffffa09e40f98000 RU 0.0 0 0 [swapper/14]
> > 0 0 15 ffffa09e40f9de80 RU 0.0 0 0 [swapper/15]
>
> It works well as expected.
>
> Reported-by: kernel test robot <lkp@...el.com>
> Signed-off-by: Yafang Shao <laoar.shao@...il.com>
> Cc: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
> Cc: Arnaldo Carvalho de Melo <arnaldo.melo@...il.com>
> Cc: Andrii Nakryiko <andrii.nakryiko@...il.com>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Steven Rostedt <rostedt@...dmis.org>
> Cc: Al Viro <viro@...iv.linux.org.uk>
> Cc: Kees Cook <keescook@...omium.org>
> Cc: Petr Mladek <pmladek@...e.com>
> ---
> fs/binfmt_elf.c | 2 +-
> include/linux/elfcore-compat.h | 3 ++-
> include/linux/elfcore.h | 4 ++--
> 3 files changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index a813b70f594e..a4ba79fce2a9 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -1572,7 +1572,7 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
> SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
> SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
> rcu_read_unlock();
> - strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
> + strscpy_pad(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
This should use get_task_comm().
>
> return 0;
> }
> diff --git a/include/linux/elfcore-compat.h b/include/linux/elfcore-compat.h
> index e272c3d452ce..afa0eb45196b 100644
> --- a/include/linux/elfcore-compat.h
> +++ b/include/linux/elfcore-compat.h
> @@ -5,6 +5,7 @@
> #include <linux/elf.h>
> #include <linux/elfcore.h>
> #include <linux/compat.h>
> +#include <linux/sched.h>
>
> /*
> * Make sure these layouts match the linux/elfcore.h native definitions.
> @@ -43,7 +44,7 @@ struct compat_elf_prpsinfo
> __compat_uid_t pr_uid;
> __compat_gid_t pr_gid;
> compat_pid_t pr_pid, pr_ppid, pr_pgrp, pr_sid;
> - char pr_fname[16];
> + char pr_fname[TASK_COMM_LEN];
> char pr_psargs[ELF_PRARGSZ];
> };
>
> diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
> index 2aaa15779d50..8d79cd58b09a 100644
> --- a/include/linux/elfcore.h
> +++ b/include/linux/elfcore.h
> @@ -65,8 +65,8 @@ struct elf_prpsinfo
> __kernel_gid_t pr_gid;
> pid_t pr_pid, pr_ppid, pr_pgrp, pr_sid;
> /* Lots missing */
> - char pr_fname[16]; /* filename of executable */
> - char pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */
> + char pr_fname[TASK_COMM_LEN]; /* filename of executable */
> + char pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */
> };
>
> static inline void elf_core_copy_regs(elf_gregset_t *elfregs, struct pt_regs *regs)
> --
> 2.17.1
>
These structs are externally parsed -- we can't change the size of
pr_fname AFAICT.
--
Kees Cook
Powered by blists - more mailing lists