lkml.org 
[lkml]   [2021]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v6 02/12] fs/exec: make __get_task_comm always get a nul terminated string
On Tue, Oct 26, 2021 at 5:08 AM Kees Cook <keescook@chromium.org> wrote:
>
> On Mon, Oct 25, 2021 at 08:33:05AM +0000, Yafang Shao wrote:
> > If the dest buffer size is smaller than sizeof(tsk->comm), the buffer
> > will be without null ternimator, that may cause problem. We can make sure
> > the buffer size not smaller than comm at the callsite to avoid that
> > problem, but there may be callsite that we can't easily change.
> >
> > Using strscpy_pad() instead of strncpy() in __get_task_comm() can make
> > the string always nul ternimated.
> >
> > Suggested-by: Kees Cook <keescook@chromium.org>
> > Suggested-by: Steven Rostedt <rostedt@goodmis.org>
> > Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> > Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
> > Cc: Arnaldo Carvalho de Melo <arnaldo.melo@gmail.com>
> > Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com>
> > Cc: Peter Zijlstra <peterz@infradead.org>
> > Cc: Steven Rostedt <rostedt@goodmis.org>
> > Cc: Al Viro <viro@zeniv.linux.org.uk>
> > Cc: Kees Cook <keescook@chromium.org>
> > Cc: Petr Mladek <pmladek@suse.com>
> > ---
> > fs/exec.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/fs/exec.c b/fs/exec.c
> > index 404156b5b314..bf2a7a91eeea 100644
> > --- a/fs/exec.c
> > +++ b/fs/exec.c
> > @@ -1209,7 +1209,8 @@ static int unshare_sighand(struct task_struct *me)
> > char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
> > {
> > task_lock(tsk);
> > - strncpy(buf, tsk->comm, buf_size);
> > + /* The copied value is always null terminated */
>
> This may could say "always NUL terminated and zero-padded"
>

Sure. I will change it.

> > + strscpy_pad(buf, tsk->comm, buf_size);
> > task_unlock(tsk);
> > return buf;
> > }
> > --
> > 2.17.1
> >
>
> But for the replacement with strscpy_pad(), yes please:
>
> Reviewed-by: Kees Cook <keescook@chromium.org>
>
>
> --
> Kees Cook



--
Thanks
Yafang

\
 
 \ /
  Last update: 2021-10-26 03:50    [W:0.123 / U:0.280 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site