lkml.org 
[lkml]   [2018]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 007/144] kthread, tracing: Dont expose half-written comm when creating kthreads
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Snild Dolkow <snild@sony.com>

    commit 3e536e222f2930534c252c1cc7ae799c725c5ff9 upstream.

    There is a window for racing when printing directly to task->comm,
    allowing other threads to see a non-terminated string. The vsnprintf
    function fills the buffer, counts the truncated chars, then finally
    writes the \0 at the end.

    creator other
    vsnprintf:
    fill (not terminated)
    count the rest trace_sched_waking(p):
    ... memcpy(comm, p->comm, TASK_COMM_LEN)
    write \0

    The consequences depend on how 'other' uses the string. In our case,
    it was copied into the tracing system's saved cmdlines, a buffer of
    adjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be):

    crash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk'
    0xffffffd5b3818640: "irq/497-pwr_evenkworker/u16:12"

    ...and a strcpy out of there would cause stack corruption:

    [224761.522292] Kernel panic - not syncing: stack-protector:
    Kernel stack is corrupted in: ffffff9bf9783c78

    crash-arm64> kbt | grep 'comm\|trace_print_context'
    #6 0xffffff9bf9783c78 in trace_print_context+0x18c(+396)
    comm (char [16]) = "irq/497-pwr_even"

    crash-arm64> rd 0xffffffd4d0e17d14 8
    ffffffd4d0e17d14: 2f71726900000000 5f7277702d373934 ....irq/497-pwr_
    ffffffd4d0e17d24: 726f776b6e657665 3a3631752f72656b evenkworker/u16:
    ffffffd4d0e17d34: f9780248ff003231 cede60e0ffffff9b 12..H.x......`..
    ffffffd4d0e17d44: cede60c8ffffffd4 00000fffffffffd4 .....`..........

    The workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was
    likely needed because of this same bug.

    Solved by vsnprintf:ing to a local buffer, then using set_task_comm().
    This way, there won't be a window where comm is not terminated.

    Link: http://lkml.kernel.org/r/20180726071539.188015-1-snild@sony.com

    Cc: stable@vger.kernel.org
    Fixes: bc0c38d139ec7 ("ftrace: latency tracer infrastructure")
    Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
    Signed-off-by: Snild Dolkow <snild@sony.com>
    Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/kthread.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    --- a/kernel/kthread.c
    +++ b/kernel/kthread.c
    @@ -290,8 +290,14 @@ static struct task_struct *__kthread_cre
    task = create->result;
    if (!IS_ERR(task)) {
    static const struct sched_param param = { .sched_priority = 0 };
    + char name[TASK_COMM_LEN];

    - vsnprintf(task->comm, sizeof(task->comm), namefmt, args);
    + /*
    + * task is already visible to other tasks, so updating
    + * COMM must be protected.
    + */
    + vsnprintf(name, sizeof(name), namefmt, args);
    + set_task_comm(task, name);
    /*
    * root may have changed our (kthreadd's) priority or CPU mask.
    * The kernel thread should not inherit these properties.

    \
     
     \ /
      Last update: 2018-08-01 19:47    [W:5.224 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site