Re: [PATCH] proc: add missing '\0' back to /proc/$pid/cmdline

From: kbuild test robot
Date: Tue Jun 19 2018 - 12:17:58 EST

Next message: Dmitry Vyukov: "Re: An example of a much more impactful way of doing file system-specific fuzzing"
Previous message: Masami Hiramatsu: "[PATCH -tip v6 27/27] kprobes: Remove jprobe stub API"
In reply to: Michal Kubecek: "Re: regression: /proc/$pid/cmdline lacks trailing '\0' in 4.18-rc1"
Next in thread: Michal Kubecek: "[PATCH] proc: add missing '\0' back to /proc/$pid/cmdline"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi Michal,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on linus/master]
[also build test WARNING on v4.18-rc1 next-20180619]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url: https://github.com/0day-ci/linux/commits/Michal-Kubecek/proc-add-missing-0-back-to-proc-pid-cmdline/20180619-210800
config: x86_64-randconfig-x015-201824 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-16) 7.3.0
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64

Note: it may well be a FALSE warning. FWIW you are at least aware of it now.
http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings

All warnings (new ones prefixed by >>):

fs/proc/base.c: In function 'proc_pid_cmdline_read':
>> fs/proc/base.c:248:9: warning: 'pos' may be used uninitialized in this function [-Wmaybe-uninitialized]
count = env_end - pos;
~~~~~~^~~~~~~~~~~~~~~
fs/proc/base.c:212:25: note: 'pos' was declared here
unsigned long req_pos, pos, len;
^~~

vim +/pos +248 fs/proc/base.c

^1da177e Linus Torvalds 2005-04-16 207
e4b4e441 Linus Torvalds 2018-05-17 208 static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
5ab82718 Linus Torvalds 2018-05-17 209 size_t count, loff_t *ppos)
^1da177e Linus Torvalds 2005-04-16 210 {
c2c0bb44 Alexey Dobriyan 2015-06-25 211 unsigned long arg_start, arg_end, env_start, env_end;
bf62f801 Michal Kubecek 2018-06-19 212 unsigned long req_pos, pos, len;
bf62f801 Michal Kubecek 2018-06-19 213 bool end_found = false;
5ab82718 Linus Torvalds 2018-05-17 214 char *page;
c2c0bb44 Alexey Dobriyan 2015-06-25 215
c2c0bb44 Alexey Dobriyan 2015-06-25 216 /* Check if process spawned far enough to have cmdline. */
e4b4e441 Linus Torvalds 2018-05-17 217 if (!mm->env_end)
e4b4e441 Linus Torvalds 2018-05-17 218 return 0;
c2c0bb44 Alexey Dobriyan 2015-06-25 219
88aa7cc6 Yang Shi 2018-06-07 220 spin_lock(&mm->arg_lock);
c2c0bb44 Alexey Dobriyan 2015-06-25 221 arg_start = mm->arg_start;
c2c0bb44 Alexey Dobriyan 2015-06-25 222 arg_end = mm->arg_end;
c2c0bb44 Alexey Dobriyan 2015-06-25 223 env_start = mm->env_start;
c2c0bb44 Alexey Dobriyan 2015-06-25 224 env_end = mm->env_end;
88aa7cc6 Yang Shi 2018-06-07 225 spin_unlock(&mm->arg_lock);
c2c0bb44 Alexey Dobriyan 2015-06-25 226
5ab82718 Linus Torvalds 2018-05-17 227 if (arg_start >= arg_end)
5ab82718 Linus Torvalds 2018-05-17 228 return 0;
6a6cbe75 Alexey Dobriyan 2018-06-07 229
2ca66ff7 Alexey Dobriyan 2014-08-08 230 /*
5ab82718 Linus Torvalds 2018-05-17 231 * We have traditionally allowed the user to re-write
5ab82718 Linus Torvalds 2018-05-17 232 * the argument strings and overflow the end result
5ab82718 Linus Torvalds 2018-05-17 233 * into the environment section. But only do that if
5ab82718 Linus Torvalds 2018-05-17 234 * the environment area is contiguous to the arguments.
2ca66ff7 Alexey Dobriyan 2014-08-08 235 */
5ab82718 Linus Torvalds 2018-05-17 236 if (env_start != arg_end || env_start >= env_end)
5ab82718 Linus Torvalds 2018-05-17 237 env_start = env_end = arg_end;
3cb4e162 Alexey Dobriyan 2018-06-07 238
5ab82718 Linus Torvalds 2018-05-17 239 /* We're not going to care if "*ppos" has high bits set */
bf62f801 Michal Kubecek 2018-06-19 240 req_pos = arg_start + *ppos;
c2c0bb44 Alexey Dobriyan 2015-06-25 241
5ab82718 Linus Torvalds 2018-05-17 242 /* .. but we do check the result is in the proper range */
bf62f801 Michal Kubecek 2018-06-19 243 if (req_pos < arg_start || req_pos >= env_end)
5ab82718 Linus Torvalds 2018-05-17 244 return 0;
3cb4e162 Alexey Dobriyan 2018-06-07 245
5ab82718 Linus Torvalds 2018-05-17 246 /* .. and we never go past env_end */
bf62f801 Michal Kubecek 2018-06-19 247 if (env_end - req_pos < count)
5ab82718 Linus Torvalds 2018-05-17 @248 count = env_end - pos;
c2c0bb44 Alexey Dobriyan 2015-06-25 249
bf62f801 Michal Kubecek 2018-06-19 250 pos = min_t(unsigned long, req_pos, arg_end - 1);
5ab82718 Linus Torvalds 2018-05-17 251 page = (char *)__get_free_page(GFP_KERNEL);
5ab82718 Linus Torvalds 2018-05-17 252 if (!page)
5ab82718 Linus Torvalds 2018-05-17 253 return -ENOMEM;
5ab82718 Linus Torvalds 2018-05-17 254
5ab82718 Linus Torvalds 2018-05-17 255 len = 0;
bf62f801 Michal Kubecek 2018-06-19 256 while (count && !end_found) {
5ab82718 Linus Torvalds 2018-05-17 257 int got;
bf62f801 Michal Kubecek 2018-06-19 258 size_t size = count + (pos < req_pos ? req_pos - pos : 0);
5ab82718 Linus Torvalds 2018-05-17 259
bf62f801 Michal Kubecek 2018-06-19 260 size = min_t(size_t, PAGE_SIZE, size);
5ab82718 Linus Torvalds 2018-05-17 261 got = access_remote_vm(mm, pos, page, size, FOLL_ANON);
5ab82718 Linus Torvalds 2018-05-17 262 if (got <= 0)
5ab82718 Linus Torvalds 2018-05-17 263 break;
5ab82718 Linus Torvalds 2018-05-17 264
5ab82718 Linus Torvalds 2018-05-17 265 /* Don't walk past a NUL character once you hit arg_end */
5ab82718 Linus Torvalds 2018-05-17 266 if (pos + got >= arg_end) {
5ab82718 Linus Torvalds 2018-05-17 267 int n = 0;
c2c0bb44 Alexey Dobriyan 2015-06-25 268
c2c0bb44 Alexey Dobriyan 2015-06-25 269 /*
5ab82718 Linus Torvalds 2018-05-17 270 * If we started before 'arg_end' but ended up
5ab82718 Linus Torvalds 2018-05-17 271 * at or after it, we start the NUL character
5ab82718 Linus Torvalds 2018-05-17 272 * check at arg_end-1 (where we expect the normal
5ab82718 Linus Torvalds 2018-05-17 273 * EOF to be).
5ab82718 Linus Torvalds 2018-05-17 274 *
5ab82718 Linus Torvalds 2018-05-17 275 * NOTE! This is smaller than 'got', because
5ab82718 Linus Torvalds 2018-05-17 276 * pos + got >= arg_end
c2c0bb44 Alexey Dobriyan 2015-06-25 277 */
5ab82718 Linus Torvalds 2018-05-17 278 if (pos < arg_end)
5ab82718 Linus Torvalds 2018-05-17 279 n = arg_end - pos - 1;
c2c0bb44 Alexey Dobriyan 2015-06-25 280
5ab82718 Linus Torvalds 2018-05-17 281 /* Cut off at first NUL after 'n' */
bf62f801 Michal Kubecek 2018-06-19 282 n += strnlen(page+n, got-n);
bf62f801 Michal Kubecek 2018-06-19 283 got = min_t(int, got, n + 1);
bf62f801 Michal Kubecek 2018-06-19 284 end_found = !page[n];
5ab82718 Linus Torvalds 2018-05-17 285 if (!got)
5ab82718 Linus Torvalds 2018-05-17 286 break;
c2c0bb44 Alexey Dobriyan 2015-06-25 287 }
c2c0bb44 Alexey Dobriyan 2015-06-25 288
bf62f801 Michal Kubecek 2018-06-19 289 if (pos + got <= req_pos) {
bf62f801 Michal Kubecek 2018-06-19 290 /* got > 0 here so that pos always advances */
bf62f801 Michal Kubecek 2018-06-19 291 pos += got;
bf62f801 Michal Kubecek 2018-06-19 292 continue;
bf62f801 Michal Kubecek 2018-06-19 293 }
bf62f801 Michal Kubecek 2018-06-19 294
bf62f801 Michal Kubecek 2018-06-19 295 if (pos < req_pos) {
bf62f801 Michal Kubecek 2018-06-19 296 got -= (req_pos - pos);
bf62f801 Michal Kubecek 2018-06-19 297 pos = req_pos;
bf62f801 Michal Kubecek 2018-06-19 298 }
5ab82718 Linus Torvalds 2018-05-17 299 got -= copy_to_user(buf, page, got);
5ab82718 Linus Torvalds 2018-05-17 300 if (unlikely(!got)) {
5ab82718 Linus Torvalds 2018-05-17 301 if (!len)
5ab82718 Linus Torvalds 2018-05-17 302 len = -EFAULT;
5ab82718 Linus Torvalds 2018-05-17 303 break;
c2c0bb44 Alexey Dobriyan 2015-06-25 304 }
5ab82718 Linus Torvalds 2018-05-17 305 pos += got;
5ab82718 Linus Torvalds 2018-05-17 306 buf += got;
5ab82718 Linus Torvalds 2018-05-17 307 len += got;
5ab82718 Linus Torvalds 2018-05-17 308 count -= got;
c2c0bb44 Alexey Dobriyan 2015-06-25 309 }
c2c0bb44 Alexey Dobriyan 2015-06-25 310
c2c0bb44 Alexey Dobriyan 2015-06-25 311 free_page((unsigned long)page);
5ab82718 Linus Torvalds 2018-05-17 312 return len;
c2c0bb44 Alexey Dobriyan 2015-06-25 313 }
c2c0bb44 Alexey Dobriyan 2015-06-25 314

:::::: The code at line 248 was first introduced by commit
:::::: 5ab8271899658042fabc5ae7e6a99066a210bc0e fs/proc: simplify and clarify get_mm_cmdline() function

:::::: TO: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
:::::: CC: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation

Attachment: .config.gz
Description: application/gzip

Next message: Dmitry Vyukov: "Re: An example of a much more impactful way of doing file system-specific fuzzing"
Previous message: Masami Hiramatsu: "[PATCH -tip v6 27/27] kprobes: Remove jprobe stub API"
In reply to: Michal Kubecek: "Re: regression: /proc/$pid/cmdline lacks trailing '\0' in 4.18-rc1"
Next in thread: Michal Kubecek: "[PATCH] proc: add missing '\0' back to /proc/$pid/cmdline"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]