| From: Snild Dolkow <snild@sony.com> |
| Date: Thu, 26 Jul 2018 09:15:39 +0200 |
| Subject: kthread, tracing: Don't expose half-written comm when creating |
| kthreads |
| |
| commit 3e536e222f2930534c252c1cc7ae799c725c5ff9 upstream. |
| |
| There is a window for racing when printing directly to task->comm, |
| allowing other threads to see a non-terminated string. The vsnprintf |
| function fills the buffer, counts the truncated chars, then finally |
| writes the \0 at the end. |
| |
| creator other |
| vsnprintf: |
| fill (not terminated) |
| count the rest trace_sched_waking(p): |
| ... memcpy(comm, p->comm, TASK_COMM_LEN) |
| write \0 |
| |
| The consequences depend on how 'other' uses the string. In our case, |
| it was copied into the tracing system's saved cmdlines, a buffer of |
| adjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be): |
| |
| crash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk' |
| 0xffffffd5b3818640: "irq/497-pwr_evenkworker/u16:12" |
| |
| ...and a strcpy out of there would cause stack corruption: |
| |
| [224761.522292] Kernel panic - not syncing: stack-protector: |
| Kernel stack is corrupted in: ffffff9bf9783c78 |
| |
| crash-arm64> kbt | grep 'comm\|trace_print_context' |
| #6 0xffffff9bf9783c78 in trace_print_context+0x18c(+396) |
| comm (char [16]) = "irq/497-pwr_even" |
| |
| crash-arm64> rd 0xffffffd4d0e17d14 8 |
| ffffffd4d0e17d14: 2f71726900000000 5f7277702d373934 ....irq/497-pwr_ |
| ffffffd4d0e17d24: 726f776b6e657665 3a3631752f72656b evenkworker/u16: |
| ffffffd4d0e17d34: f9780248ff003231 cede60e0ffffff9b 12..H.x......`.. |
| ffffffd4d0e17d44: cede60c8ffffffd4 00000fffffffffd4 .....`.......... |
| |
| The workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was |
| likely needed because of this same bug. |
| |
| Solved by vsnprintf:ing to a local buffer, then using set_task_comm(). |
| This way, there won't be a window where comm is not terminated. |
| |
| Link: http://lkml.kernel.org/r/20180726071539.188015-1-snild@sony.com |
| |
| Fixes: bc0c38d139ec7 ("ftrace: latency tracer infrastructure") |
| Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org> |
| Signed-off-by: Snild Dolkow <snild@sony.com> |
| Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> |
| [bwh: Backported to 3.16: adjust context] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| kernel/kthread.c | 8 +++++++- |
| 1 file changed, 7 insertions(+), 1 deletion(-) |
| |
| --- a/kernel/kthread.c |
| +++ b/kernel/kthread.c |
| @@ -309,10 +309,16 @@ struct task_struct *kthread_create_on_no |
| if (!IS_ERR(task)) { |
| static const struct sched_param param = { .sched_priority = 0 }; |
| va_list args; |
| + char name[TASK_COMM_LEN]; |
| |
| + /* |
| + * task is already visible to other tasks, so updating |
| + * COMM must be protected. |
| + */ |
| va_start(args, namefmt); |
| - vsnprintf(task->comm, sizeof(task->comm), namefmt, args); |
| + vsnprintf(name, sizeof(name), namefmt, args); |
| va_end(args); |
| + set_task_comm(task, name); |
| /* |
| * root may have changed our (kthreadd's) priority or CPU mask. |
| * The kernel thread should not inherit these properties. |