• Snild Dolkow's avatar
    kthread, tracing: Don't expose half-written comm when creating kthreads · f9574568
    Snild Dolkow authored
    commit 3e536e22 upstream.
    There is a window for racing when printing directly to task->comm,
    allowing other threads to see a non-terminated string. The vsnprintf
    function fills the buffer, counts the truncated chars, then finally
    writes the \0 at the end.
    	creator                     other
    	  fill (not terminated)
    	  count the rest            trace_sched_waking(p):
    	  ...                         memcpy(comm, p->comm, TASK_COMM_LEN)
    	  write \0
    The consequences depend on how 'other' uses the string. In our case,
    it was copied into the tracing system's saved cmdlines, a buffer of
    adjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be):
    	crash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk'
    	0xffffffd5b3818640:     "irq/497-pwr_evenkworker/u16:12"
    ...and a strcpy out of there would cause stack corruption:
    	[224761.522292] Kernel panic - not syncing: stack-protector:
    	    Kernel stack is corrupted in: ffffff9bf9783c78
    	crash-arm64> kbt | grep 'comm\|trace_print_context'
    	#6  0xffffff9bf9783c78 in trace_print_context+0x18c(+396)
    	      comm (char [16]) =  "irq/497-pwr_even"
    	crash-arm64> rd 0xffffffd4d0e17d14 8
    	ffffffd4d0e17d14:  2f71726900000000 5f7277702d373934   ....irq/497-pwr_
    	ffffffd4d0e17d24:  726f776b6e657665 3a3631752f72656b   evenkworker/u16:
    	ffffffd4d0e17d34:  f9780248ff003231 cede60e0ffffff9b   12..H.x......`..
    	ffffffd4d0e17d44:  cede60c8ffffffd4 00000fffffffffd4   .....`..........
    The workaround in e09e2867 (use strlcpy in __trace_find_cmdline) was
    likely needed because of this same bug.
    Solved by vsnprintf:ing to a local buffer, then using set_task_comm().
    This way, there won't be a window where comm is not terminated.
    Link: http://lkml.kernel.org/r/20180726071539.188015-1-snild@sony.com
    Cc: stable@vger.kernel.org
    Fixes: bc0c38d1 ("ftrace: latency tracer infrastructure")
    Reviewed-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
    Signed-off-by: default avatarSnild Dolkow <snild@sony.com>
    Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
kthread.c 32.2 KB