On Tue, Oct 26, 2021 at 5:08 AM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> On Mon, Oct 25, 2021 at 08:33:05AM +0000, Yafang Shao wrote:
> > If the dest buffer size is smaller than sizeof(tsk->comm), the buffer
> > will be without null ternimator, that may cause problem. We can make sure
> > the buffer size not smaller than comm at the callsite to avoid that
> > problem, but there may be callsite that we can't easily change.
> >
> > Using strscpy_pad() instead of strncpy() in __get_task_comm() can make
> > the string always nul ternimated.
> >
> > Suggested-by: Kees Cook <keescook@xxxxxxxxxxxx>
> > Suggested-by: Steven Rostedt <rostedt@xxxxxxxxxxx>
> > Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx>
> > Cc: Mathieu Desnoyers <mathieu.desnoyers@xxxxxxxxxxxx>
> > Cc: Arnaldo Carvalho de Melo <arnaldo.melo@xxxxxxxxx>
> > Cc: Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx>
> > Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
> > Cc: Steven Rostedt <rostedt@xxxxxxxxxxx>
> > Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> > Cc: Kees Cook <keescook@xxxxxxxxxxxx>
> > Cc: Petr Mladek <pmladek@xxxxxxxx>
> > ---
> > fs/exec.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/fs/exec.c b/fs/exec.c
> > index 404156b5b314..bf2a7a91eeea 100644
> > --- a/fs/exec.c
> > +++ b/fs/exec.c
> > @@ -1209,7 +1209,8 @@ static int unshare_sighand(struct task_struct *me)
> > char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
> > {
> > task_lock(tsk);
> > - strncpy(buf, tsk->comm, buf_size);
> > + /* The copied value is always null terminated */
>
> This may could say "always NUL terminated and zero-padded"
>
Sure. I will change it.
> > + strscpy_pad(buf, tsk->comm, buf_size);
> > task_unlock(tsk);
> > return buf;
> > }
> > --
> > 2.17.1
> >
>
> But for the replacement with strscpy_pad(), yes please:
>
> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
>
>
> --
> Kees Cook
--
Thanks
Yafang
