Messages in this thread | | | Date | Mon, 23 Jul 2018 09:55:50 -0400 | From | Steven Rostedt <> | Subject | Re: [PATCH RESEND] kthread, tracing: Don't expose half-written comm when creating kthreads |
| |
On Mon, 23 Jul 2018 15:42:10 +0200 Snild Dolkow <snild@sony.com> wrote:
> There was a window for racing when task->comm was being written. The > vsnprintf function writes 16 bytes, then counts the rest, then null > terminates. In the meantime, other threads could see the non-terminated > comm value. In our case, it got into the trace system's saved cmdlines > and could cause stack corruption when strcpy'd out of there. > > The workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was > likely needed because of this bug. > > Solved by vsnprintf:ing to a local buffer, then using set_task_comm(). > > Signed-off-by: Snild Dolkow <snild@sony.com> > --- > kernel/kthread.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/kernel/kthread.c b/kernel/kthread.c > index 481951bf091d..28874afbf747 100644 > --- a/kernel/kthread.c > +++ b/kernel/kthread.c > @@ -319,8 +319,10 @@ struct task_struct *__kthread_create_on_node(int (*threadfn)(void *data), > task = create->result; > if (!IS_ERR(task)) { > static const struct sched_param param = { .sched_priority = 0 }; > + char name[TASK_COMM_LEN]; > > - vsnprintf(task->comm, sizeof(task->comm), namefmt, args);
Can you add a comment here stating something to the affect of:
/* task is now visible to other tasks */
-- Steve
> + vsnprintf(name, sizeof(name), namefmt, args); > + set_task_comm(task, name); > /* > * root may have changed our (kthreadd's) priority or CPU mask. > * The kernel thread should not inherit these properties.
| |