From: Steven Rostedt <rostedt@goodmis.org>
To: Snild Dolkow <snild@sony.com>
Cc: <linux-kernel@vger.kernel.org>, Ingo Molnar <mingo@kernel.org>,
Jens Axboe <axboe@kernel.dk>, Tejun Heo <tj@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Peter Enderborg <peter.enderborg@sony.com>,
Yoshitaka Seto <yoshitaka.seto@sony.com>,
Oleksiy Avramchenko <oleksiy.avramchenko@sony.com>,
KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>,
John Stultz <john.stultz@linaro.org>
Subject: Re: [PATCH RESEND] kthread, tracing: Don't expose half-written comm when creating kthreads
Date: Tue, 24 Jul 2018 10:48:15 -0400 [thread overview]
Message-ID: <20180724104815.05d2ac68@gandalf.local.home> (raw)
In-Reply-To: <72573a9f-694e-fc4b-cfd1-d9cde504a480@sony.com>
On Tue, 24 Jul 2018 10:17:37 +0200
Snild Dolkow <snild@sony.com> wrote:
> On 07/23/2018 06:41 PM, Steven Rostedt wrote:
> > On Mon, 23 Jul 2018 17:49:36 +0200
> > Snild Dolkow <snild@sony.com> wrote:
> >> Any issues with the commit message? Reading it back again now, it doesn't
> >> seem quite as clear as when I wrote it.
> >
> > Yeah, I think it does need some updates:
> >
> >> There was a window for racing when task->comm was being written. The
> >
> > It would be nice to explain this race window in more detail.
> >
> I hope the following is more clear:
>
> kthread, tracing: Don't expose half-written comm when creating kthreads
>
> There is a window for racing when printing directly to task->comm,
> allowing other threads to see a non-terminated string. The vsnprintf
> function fills the buffer, counts the truncated chars, then finally
> writes the \0 at the end.
>
> creator other
> vsnprintf:
> fill (not terminated)
> count the rest read/use comm
I think it would be better to state what was reading the comm. Like
trace_sched_waking(p)
memcpy(comm, p->comm, TASK_COMM_LEN)
But the rest looks fine.
-- Steve
> write \0
>
> The consequences depend on how 'other' uses the string. In our case,
> it was copied into the tracing system's saved cmdlines, a buffer of
> adjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be):
>
> crash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk'
> 0xffffffd5b3818640: "irq/497-pwr_evenkworker/u16:12"
>
> ...and a strcpy out of there would cause stack corruption:
>
> [224761.522292] Kernel panic - not syncing: stack-protector:
> Kernel stack is corrupted in: ffffff9bf9783c78
>
> crash-arm64> kbt | grep 'comm\|trace_print_context'
> #6 0xffffff9bf9783c78 in trace_print_context+0x18c(+396)
> comm (char [16]) = "irq/497-pwr_even"
>
> crash-arm64> rd 0xffffffd4d0e17d14 8
> ffffffd4d0e17d14: 2f71726900000000 5f7277702d373934 ....irq/497-pwr_
> ffffffd4d0e17d24: 726f776b6e657665 3a3631752f72656b evenkworker/u16:
> ffffffd4d0e17d34: f9780248ff003231 cede60e0ffffff9b 12..H.x......`..
> ffffffd4d0e17d44: cede60c8ffffffd4 00000fffffffffd4 .....`..........
>
> The workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was
> likely needed because of this same bug.
>
> Solved by vsnprintf:ing to a local buffer, then using set_task_comm().
> This way, there won't be a window where comm is not terminated.
>
>
> //Snild
next prev parent reply other threads:[~2018-07-24 14:48 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-23 13:42 [PATCH RESEND] kthread, tracing: Don't expose half-written comm when creating kthreads Snild Dolkow
2018-07-23 13:55 ` Steven Rostedt
2018-07-23 14:23 ` Snild Dolkow
2018-07-23 15:37 ` Steven Rostedt
2018-07-23 15:49 ` Snild Dolkow
2018-07-23 16:41 ` Steven Rostedt
2018-07-24 8:17 ` Snild Dolkow
2018-07-24 14:48 ` Steven Rostedt [this message]
2018-07-24 15:02 ` Snild Dolkow
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180724104815.05d2ac68@gandalf.local.home \
--to=rostedt@goodmis.org \
--cc=axboe@kernel.dk \
--cc=gregkh@linuxfoundation.org \
--cc=john.stultz@linaro.org \
--cc=kosaki.motohiro@jp.fujitsu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=oleksiy.avramchenko@sony.com \
--cc=peter.enderborg@sony.com \
--cc=snild@sony.com \
--cc=tj@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=yoshitaka.seto@sony.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).