lkml.org 
[lkml]   [2022]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2] cgroup: align the comm length with TASK_COMM_LEN
On Fri, 23 Sep 2022 15:51:05 +0800
Kassey Li <quic_yingangl@quicinc.com> wrote:

> __string could get a dst string with length less than
> TASK_COMM_LEN.
>
> A task->comm may change that can cause out of bounds access
> for the dst string buffer, e.g in the call trace of below:
>
> Call trace:
>
> dump_backtrace.cfi_jt+0x0/0x4
> show_stack+0x14/0x1c
> dump_stack+0xa0/0xd8
> die_callback+0x248/0x24c
> notify_die+0x7c/0xf8
> die+0xac/0x290
> die_kernel_fault+0x88/0x98
> die_kernel_fault+0x0/0x98
> do_page_fault+0xa0/0x544
> do_mem_abort+0x60/0x10c
> el1_da+0x1c/0xc4

> trace_event_raw_event_cgroup_migrate+0x124/0x170

You're sure the above is on the strcpy()?

Note, this code has __string() which does a strlen() which appears to be
working fine.

> cgroup_attach_task+0x2e8/0x41c
> __cgroup1_procs_write+0x114/0x1ec
> cgroup1_tasks_write+0x10/0x18
> cgroup_file_write+0xa4/0x208
> kernfs_fop_write+0x1f0/0x2f4
> __vfs_write+0x5c/0x200
> vfs_write+0xe0/0x1a0
> ksys_write+0x74/0xdc
> __arm64_sys_write+0x18/0x20
> el0_svc_common+0xc0/0x1a4
> el0_svc_compat_handler+0x18/0x20
> el0_svc_compat+0x8/0x2c

Can you give the full debug report, that includes the register content and
everything else.

-- Steve

\
 
 \ /
  Last update: 2022-09-26 17:24    [W:0.079 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site