Re: [PATCH v6 05/12] elfcore: make prpsinfo always get a nul terminated task comm

[Yafang Shao]

On Tue, Oct 26, 2021 at 5:18 AM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> On Mon, Oct 25, 2021 at 08:33:08AM +0000, Yafang Shao wrote:
> > kernel test robot reported a -Wstringop-truncation warning after I
> > extend task comm from 16 to 24. Below is the detailed warning:
> >
> >    fs/binfmt_elf.c: In function 'fill_psinfo.isra':
> > >> fs/binfmt_elf.c:1575:9: warning: 'strncpy' output may be truncated copying 16 bytes from a string of length 23 [-Wstringop-truncation]
> >     1575 |         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
> >          |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >
> > This patch can fix this warning.
> >
> > Replacing strncpy() with strscpy_pad() can avoid this warning.
> >
> > This patch also replace the hard-coded 16 with TASK_COMM_LEN to make it
> > more compatible with task comm size change.
> >
> > I also verfied if it still work well when I extend the comm size to 24.
> > struct elf_prpsinfo is used to dump the task information in userspace
> > coredump or kernel vmcore. Below is the verfication of vmcore,
> >
> > crash> ps
> >    PID    PPID  CPU       TASK        ST  %MEM     VSZ    RSS  COMM
> >       0      0   0  ffffffff9d21a940  RU   0.0       0      0  [swapper/0]
> > >     0      0   1  ffffa09e40f85e80  RU   0.0       0      0  [swapper/1]
> > >     0      0   2  ffffa09e40f81f80  RU   0.0       0      0  [swapper/2]
> > >     0      0   3  ffffa09e40f83f00  RU   0.0       0      0  [swapper/3]
> > >     0      0   4  ffffa09e40f80000  RU   0.0       0      0  [swapper/4]
> > >     0      0   5  ffffa09e40f89f80  RU   0.0       0      0  [swapper/5]
> >       0      0   6  ffffa09e40f8bf00  RU   0.0       0      0  [swapper/6]
> > >     0      0   7  ffffa09e40f88000  RU   0.0       0      0  [swapper/7]
> > >     0      0   8  ffffa09e40f8de80  RU   0.0       0      0  [swapper/8]
> > >     0      0   9  ffffa09e40f95e80  RU   0.0       0      0  [swapper/9]
> > >     0      0  10  ffffa09e40f91f80  RU   0.0       0      0  [swapper/10]
> > >     0      0  11  ffffa09e40f93f00  RU   0.0       0      0  [swapper/11]
> > >     0      0  12  ffffa09e40f90000  RU   0.0       0      0  [swapper/12]
> > >     0      0  13  ffffa09e40f9bf00  RU   0.0       0      0  [swapper/13]
> > >     0      0  14  ffffa09e40f98000  RU   0.0       0      0  [swapper/14]
> > >     0      0  15  ffffa09e40f9de80  RU   0.0       0      0  [swapper/15]
> >
> > It works well as expected.
> >
> > Reported-by: kernel test robot <lkp@xxxxxxxxx>
> > Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx>
> > Cc: Mathieu Desnoyers <mathieu.desnoyers@xxxxxxxxxxxx>
> > Cc: Arnaldo Carvalho de Melo <arnaldo.melo@xxxxxxxxx>
> > Cc: Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx>
> > Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
> > Cc: Steven Rostedt <rostedt@xxxxxxxxxxx>
> > Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> > Cc: Kees Cook <keescook@xxxxxxxxxxxx>
> > Cc: Petr Mladek <pmladek@xxxxxxxx>
> > ---
> >  fs/binfmt_elf.c                | 2 +-
> >  include/linux/elfcore-compat.h | 3 ++-
> >  include/linux/elfcore.h        | 4 ++--
> >  3 files changed, 5 insertions(+), 4 deletions(-)
> >
> > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> > index a813b70f594e..a4ba79fce2a9 100644
> > --- a/fs/binfmt_elf.c
> > +++ b/fs/binfmt_elf.c
> > @@ -1572,7 +1572,7 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
> >       SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
> >       SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
> >       rcu_read_unlock();
> > -     strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
> > +     strscpy_pad(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
>
> This should use get_task_comm().
>

Sure.

> >
> >       return 0;
> >  }
> > diff --git a/include/linux/elfcore-compat.h b/include/linux/elfcore-compat.h
> > index e272c3d452ce..afa0eb45196b 100644
> > --- a/include/linux/elfcore-compat.h
> > +++ b/include/linux/elfcore-compat.h
> > @@ -5,6 +5,7 @@
> >  #include <linux/elf.h>
> >  #include <linux/elfcore.h>
> >  #include <linux/compat.h>
> > +#include <linux/sched.h>
> >
> >  /*
> >   * Make sure these layouts match the linux/elfcore.h native definitions.
> > @@ -43,7 +44,7 @@ struct compat_elf_prpsinfo
> >       __compat_uid_t                  pr_uid;
> >       __compat_gid_t                  pr_gid;
> >       compat_pid_t                    pr_pid, pr_ppid, pr_pgrp, pr_sid;
> > -     char                            pr_fname[16];
> > +     char                            pr_fname[TASK_COMM_LEN];
> >       char                            pr_psargs[ELF_PRARGSZ];
> >  };
> >
> > diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
> > index 2aaa15779d50..8d79cd58b09a 100644
> > --- a/include/linux/elfcore.h
> > +++ b/include/linux/elfcore.h
> > @@ -65,8 +65,8 @@ struct elf_prpsinfo
> >       __kernel_gid_t  pr_gid;
> >       pid_t   pr_pid, pr_ppid, pr_pgrp, pr_sid;
> >       /* Lots missing */
> > -     char    pr_fname[16];   /* filename of executable */
> > -     char    pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */
> > +     char    pr_fname[TASK_COMM_LEN];        /* filename of executable */
> > +     char    pr_psargs[ELF_PRARGSZ];         /* initial part of arg list */
> >  };
> >
> >  static inline void elf_core_copy_regs(elf_gregset_t *elfregs, struct pt_regs *regs)
> > --
> > 2.17.1
> >
>
> These structs are externally parsed -- we can't change the size of
> pr_fname AFAICT.
>

Yes, they are parsed by crash utility and other tools.
I will keep pr_fname as-is.

-- 
Thanks
Yafang