Messages in this thread | | | Subject | Re: [PATCH RESEND] kthread, tracing: Don't expose half-written comm when creating kthreads | From | Snild Dolkow <> | Date | Tue, 24 Jul 2018 10:17:37 +0200 |
| |
On 07/23/2018 06:41 PM, Steven Rostedt wrote: > On Mon, 23 Jul 2018 17:49:36 +0200 > Snild Dolkow <snild@sony.com> wrote: >> Any issues with the commit message? Reading it back again now, it doesn't >> seem quite as clear as when I wrote it. > > Yeah, I think it does need some updates: > >> There was a window for racing when task->comm was being written. The > > It would be nice to explain this race window in more detail. > I hope the following is more clear:
kthread, tracing: Don't expose half-written comm when creating kthreads
There is a window for racing when printing directly to task->comm, allowing other threads to see a non-terminated string. The vsnprintf function fills the buffer, counts the truncated chars, then finally writes the \0 at the end.
creator other vsnprintf: fill (not terminated) count the rest read/use comm write \0
The consequences depend on how 'other' uses the string. In our case, it was copied into the tracing system's saved cmdlines, a buffer of adjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be):
crash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk' 0xffffffd5b3818640: "irq/497-pwr_evenkworker/u16:12"
...and a strcpy out of there would cause stack corruption:
[224761.522292] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffff9bf9783c78
crash-arm64> kbt | grep 'comm\|trace_print_context' #6 0xffffff9bf9783c78 in trace_print_context+0x18c(+396) comm (char [16]) = "irq/497-pwr_even"
crash-arm64> rd 0xffffffd4d0e17d14 8 ffffffd4d0e17d14: 2f71726900000000 5f7277702d373934 ....irq/497-pwr_ ffffffd4d0e17d24: 726f776b6e657665 3a3631752f72656b evenkworker/u16: ffffffd4d0e17d34: f9780248ff003231 cede60e0ffffff9b 12..H.x......`.. ffffffd4d0e17d44: cede60c8ffffffd4 00000fffffffffd4 .....`..........
The workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was likely needed because of this same bug.
Solved by vsnprintf:ing to a local buffer, then using set_task_comm(). This way, there won't be a window where comm is not terminated.
//Snild
| |