From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4528C27C79 for ; Thu, 13 Jun 2024 21:14:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E78DC6B008A; Thu, 13 Jun 2024 17:14:44 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E288D6B008C; Thu, 13 Jun 2024 17:14:44 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CEF7F6B0092; Thu, 13 Jun 2024 17:14:44 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id AF9656B008A for ; Thu, 13 Jun 2024 17:14:44 -0400 (EDT) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 61DD21C07F7 for ; Thu, 13 Jun 2024 21:14:44 +0000 (UTC) X-FDA: 82227119688.04.62892A5 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by imf29.hostedemail.com (Postfix) with ESMTP id 1456012000B for ; Thu, 13 Jun 2024 21:14:41 +0000 (UTC) Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=EMg5zEp0; dmarc=none; spf=pass (imf29.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1718313281; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=GZ+Tvg8R4YxH1pWEH+KFRgCqr6RlOjMkABBvp7FRaYs=; b=g2r8oOtlGCCT5p3kPSCe5oJdlV8TE0+CMxaHcuh7AIK1fx0Jd3TBaBcIuMHe5C0Mmdp86u ZJLArzugZGd61anHUeHYYcvXgNqb49A8X5byNXuscODM3Xdoyqq7b/uiV0Y2iNlTZVMTQd 10IOB2pu3lnacpis+Rwhfruv9yOk/ZY= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1718313281; a=rsa-sha256; cv=none; b=es7qSpkQf8LsHyUwqBNr2cldj5Mjb1tj2EZqUOcQsYHJ+0SMZGw4+ouNExXnRqnDGkEGmh dMH+uwUp34zocxp5nQIwuM/T8H+cdzbZA5dW7+mFB5CMB2fSh3fMLC7sTfuJTEyrlkMTeL CDhzqilBMS297RaqI73SRhS4QzRI58E= ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=EMg5zEp0; dmarc=none; spf=pass (imf29.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id A028CCE27D1; Thu, 13 Jun 2024 21:14:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83E20C2BBFC; Thu, 13 Jun 2024 21:14:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1718313277; bh=4a2+5zIfwargPvYAlTmLGH6pFw0rZamk0P9b4EVRVsM=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=EMg5zEp0mO+NhF6jvPGvPYkQn8Gd0u2aw4kR2cAYBNOQj5bRnNWwQM9CehUe95cZs 6Ig1y6VAXMhH/JYy3dPHM1EG0vGdCUoJaJs1tYAbb6NeSB3p4cP0PLop0SsGaGcGr6 fg74mWAVBAHGreHe41TJIWG8GiGZhlI1Nb5wr4hM= Date: Thu, 13 Jun 2024 14:14:35 -0700 From: Andrew Morton To: Yafang Shao Cc: torvalds@linux-foundation.org, ebiederm@xmission.com, alexei.starovoitov@gmail.com, rostedt@goodmis.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, audit@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org, bpf@vger.kernel.org, netdev@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH v2 05/10] mm/util: Fix possible race condition in kstrdup() Message-Id: <20240613141435.fad09579c934dbb79a3086cc@linux-foundation.org> In-Reply-To: <20240613023044.45873-6-laoar.shao@gmail.com> References: <20240613023044.45873-1-laoar.shao@gmail.com> <20240613023044.45873-6-laoar.shao@gmail.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 1456012000B X-Stat-Signature: 6uhzpmnm9eyqco6x6yhuizqcj6b34qz6 X-Rspam-User: X-HE-Tag: 1718313281-711734 X-HE-Meta: U2FsdGVkX18NXgrdnm/U+N9qJWLjkmUgqoo7BVZ77AGWSurkUSZ1lkRbFhlrSvtJZASX7/hkMXhl/OPbKYIL87166UwNyV6o7g1kp1dzUTozUWHarQsZsoE+H0iu5PMTnIk4jY6+e7GOL85/wdN3bxPJmOa2mcE5ZXe5KCYnh2pbZbeQQqoJoK+NMSlnxfscLReKRYw4ZRoDHwes0M8SPtbKODGjhH8AOa05kz5dxrrNuWbLEmKENL+YpjYNZIqIVRXsRyPdhCc9GLLmbRqW1tRWqyFpRK+bkblV2cF+TfJnCy6NdBtprOy9qRqAHYLd0h4+p5nf2xs7lthmbZBOTK8SQuNgQzYOKpjgPKSgSYklJFHfQUGsaZkbje53o65wx3uzuoyK0MjgeY9RDHdUUHett3lkOtRf/IT50tML+Kr1hsiQcxUiRd1cMb5ccy62DFgnOScr1W7EZriyiweDA/9KHnwLrVh22lh6BIFK9J6R8K19dw0MSHSq2xQM0H62emcs5pJFbzWkpRhsUUrUwVjbFY3FfEC8TcqwgJ/2excHvq9IDVIVLEHQYwB0IQUcE+sYjqs34voeEP/jZMEINKtrFwhpDxd/HR8WR8YZbeE4vrR5Vc6jldfN6voAnE3BmCF4YTnRcIbwiZVBC+wrvksrtMzIjVLMbxmCbVV1A1LoTjffnpqqAYZ5aveqfyILLHzIHrHc1jXEfJfpbJXAdpQqL0HFTXBJUp3zUQw3r0Aec2czkqkawI31EsXOnS8+0GbesX+0AarKiLXg0TN8x2i7QfnS/Uonpv5av9N58aBPxQCKMPCWPI03WCoNz7EkBem8NfQteCwVpl5jrn0X+3QgDOBaUEm51pAgw5pq9ALVVSCQAl0/2lQJCV1so8rzeu6ibQrK7VBuNJCAcgBdKQaSuF1r3keyUcERpfZb/CGwiJKp9nRahMp9W3vWRM7flmDMFBjQHzHJyNT+AYy IgAv/lhf Ht8ADEUYqcPBS+xeFaWmInfLNzFH/XJzg97zjvJqMdU+gsuzwc3tTRoCLowh+8R4sTRPunelEUBpDeQS+RkBJsmmQtINgGOV1JUfW6M20hFqxVA+TubSYQv+mpEoZ3/hyrKqi6KbGZjit1+QnTUC5eYuy8i/K6GjJiJlmplt8v2sASUy8gA0xCkoK68w0maO4jHU8QRKEb2yQFtCPtkf0cEdv53qTIJ/1B2y9Hxe/fF1Jq1BWRzaB69CKsF7IeNcBoBcOVnIOKQTNqXj8gmvUeL76M+qR/nUfZTB8mT+FuKTo9Kmj9ysmzCMOWR+WlTVfNVIe X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, 13 Jun 2024 10:30:39 +0800 Yafang Shao wrote: > In kstrdup(), it is critical to ensure that the dest string is always > NUL-terminated. However, potential race condidtion can occur between a > writer and a reader. > > Consider the following scenario involving task->comm: > > reader writer > > len = strlen(s) + 1; > strlcpy(tsk->comm, buf, sizeof(tsk->comm)); > memcpy(buf, s, len); > > In this case, there is a race condition between the reader and the > writer. The reader calculate the length of the string `s` based on the > old value of task->comm. However, during the memcpy(), the string `s` > might be updated by the writer to a new value of task->comm. > > If the new task->comm is larger than the old one, the `buf` might not be > NUL-terminated. This can lead to undefined behavior and potential > security vulnerabilities. > > Let's fix it by explicitly adding a NUL-terminator. The concept sounds a little strange. If some code takes a copy of a string while some other code is altering it, yes, the result will be a mess. This is why get_task_comm() exists, and why it uses locking. I get that "your copy is a mess" is less serious than "your string isn't null-terminated" but still. Whichever outcome we get, the calling code is buggy and should be fixed. Are there any other problematic scenarios we're defending against here? > > --- a/mm/util.c > +++ b/mm/util.c > @@ -60,8 +60,10 @@ char *kstrdup(const char *s, gfp_t gfp) > > len = strlen(s) + 1; > buf = kmalloc_track_caller(len, gfp); > - if (buf) > + if (buf) { > memcpy(buf, s, len); > + buf[len - 1] = '\0'; > + } > return buf; > } Now I'll start receiving patches to remove this again. Let's have a code comment please. And kstrdup() is now looking awfully similar to kstrndup(). Perhaps there's a way to reduce duplication?