From: Yafang Shao <laoar.shao@xxxxxxxxx> Subject: fs/exec: replace strncpy with strscpy_pad in __get_task_comm If the dest buffer size is smaller than sizeof(tsk->comm), the buffer will be without null ternimator, that may cause problem. Using strscpy_pad() instead of strncpy() in __get_task_comm() can make the string always nul ternimated and zero padded. Link: https://lkml.kernel.org/r/20211120112738.45980-3-laoar.shao@xxxxxxxxx Suggested-by: Kees Cook <keescook@xxxxxxxxxxxx> Suggested-by: Steven Rostedt <rostedt@xxxxxxxxxxx> Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> Reviewed-by: David Hildenbrand <david@xxxxxxxxxx> Cc: Mathieu Desnoyers <mathieu.desnoyers@xxxxxxxxxxxx> Cc: Arnaldo Carvalho de Melo <arnaldo.melo@xxxxxxxxx> Cc: Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx> Cc: Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> Cc: Michal Miroslaw <mirq-linux@xxxxxxxxxxxx> Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx> Cc: Steven Rostedt <rostedt@xxxxxxxxxxx> Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx> Cc: David Hildenbrand <david@xxxxxxxxxx> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Kees Cook <keescook@xxxxxxxxxxxx> Cc: Petr Mladek <pmladek@xxxxxxxx> Cc: Andrii Nakryiko <andrii@xxxxxxxxxx> Cc: Dennis Dalessandro <dennis.dalessandro@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/exec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/exec.c~fs-exec-replace-strncpy-with-strscpy_pad-in-__get_task_comm +++ a/fs/exec.c @@ -1207,7 +1207,8 @@ static int unshare_sighand(struct task_s char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk) { task_lock(tsk); - strncpy(buf, tsk->comm, buf_size); + /* Always NUL terminated and zero-padded */ + strscpy_pad(buf, tsk->comm, buf_size); task_unlock(tsk); return buf; } _
