On Tue, Oct 26, 2021 at 5:18 AM Kees Cook [off-list ref] wrote:

On Mon, Oct 25, 2021 at 08:33:08AM +0000, Yafang Shao wrote:

quoted

kernel test robot reported a -Wstringop-truncation warning after I
extend task comm from 16 to 24. Below is the detailed warning:

   fs/binfmt_elf.c: In function 'fill_psinfo.isra':

quoted

quoted

fs/binfmt_elf.c:1575:9: warning: 'strncpy' output may be truncated copying 16 bytes from a string of length 23 [-Wstringop-truncation]

    1575 |         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
         |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This patch can fix this warning.

Replacing strncpy() with strscpy_pad() can avoid this warning.

This patch also replace the hard-coded 16 with TASK_COMM_LEN to make it
more compatible with task comm size change.

I also verfied if it still work well when I extend the comm size to 24.
struct elf_prpsinfo is used to dump the task information in userspace
coredump or kernel vmcore. Below is the verfication of vmcore,

crash> ps
   PID    PPID  CPU       TASK        ST  %MEM     VSZ    RSS  COMM
      0      0   0  ffffffff9d21a940  RU   0.0       0      0  [swapper/0]

quoted

    0      0   1  ffffa09e40f85e80  RU   0.0       0      0  [swapper/1]
    0      0   2  ffffa09e40f81f80  RU   0.0       0      0  [swapper/2]
    0      0   3  ffffa09e40f83f00  RU   0.0       0      0  [swapper/3]
    0      0   4  ffffa09e40f80000  RU   0.0       0      0  [swapper/4]
    0      0   5  ffffa09e40f89f80  RU   0.0       0      0  [swapper/5]

      0      0   6  ffffa09e40f8bf00  RU   0.0       0      0  [swapper/6]

quoted

    0      0   7  ffffa09e40f88000  RU   0.0       0      0  [swapper/7]
    0      0   8  ffffa09e40f8de80  RU   0.0       0      0  [swapper/8]
    0      0   9  ffffa09e40f95e80  RU   0.0       0      0  [swapper/9]
    0      0  10  ffffa09e40f91f80  RU   0.0       0      0  [swapper/10]
    0      0  11  ffffa09e40f93f00  RU   0.0       0      0  [swapper/11]
    0      0  12  ffffa09e40f90000  RU   0.0       0      0  [swapper/12]
    0      0  13  ffffa09e40f9bf00  RU   0.0       0      0  [swapper/13]
    0      0  14  ffffa09e40f98000  RU   0.0       0      0  [swapper/14]
    0      0  15  ffffa09e40f9de80  RU   0.0       0      0  [swapper/15]

It works well as expected.

Reported-by: kernel test robot <redacted>
Signed-off-by: Yafang Shao <redacted>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Arnaldo Carvalho de Melo <redacted>
Cc: Andrii Nakryiko <redacted>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Kees Cook <redacted>
Cc: Petr Mladek <pmladek@suse.com>
---
 fs/binfmt_elf.c                | 2 +-
 include/linux/elfcore-compat.h | 3 ++-
 include/linux/elfcore.h        | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index a813b70f594e..a4ba79fce2a9 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c

@@ -1572,7 +1572,7 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
      SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
      SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
      rcu_read_unlock();
-     strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
+     strscpy_pad(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));

This should use get_task_comm().

Sure.

quoted

      return 0;
 }

diff --git a/include/linux/elfcore-compat.h b/include/linux/elfcore-compat.h
index e272c3d452ce..afa0eb45196b 100644
--- a/include/linux/elfcore-compat.h
+++ b/include/linux/elfcore-compat.h

@@ -5,6 +5,7 @@
 #include <linux/elf.h>
 #include <linux/elfcore.h>
 #include <linux/compat.h>
+#include <linux/sched.h>

 /*
  * Make sure these layouts match the linux/elfcore.h native definitions.

@@ -43,7 +44,7 @@ struct compat_elf_prpsinfo
      __compat_uid_t                  pr_uid;
      __compat_gid_t                  pr_gid;
      compat_pid_t                    pr_pid, pr_ppid, pr_pgrp, pr_sid;
-     char                            pr_fname[16];
+     char                            pr_fname[TASK_COMM_LEN];
      char                            pr_psargs[ELF_PRARGSZ];
 };

diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
index 2aaa15779d50..8d79cd58b09a 100644
--- a/include/linux/elfcore.h
+++ b/include/linux/elfcore.h

@@ -65,8 +65,8 @@ struct elf_prpsinfo
      __kernel_gid_t  pr_gid;
      pid_t   pr_pid, pr_ppid, pr_pgrp, pr_sid;
      /* Lots missing */
-     char    pr_fname[16];   /* filename of executable */
-     char    pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */
+     char    pr_fname[TASK_COMM_LEN];        /* filename of executable */
+     char    pr_psargs[ELF_PRARGSZ];         /* initial part of arg list */
 };

 static inline void elf_core_copy_regs(elf_gregset_t *elfregs, struct pt_regs *regs)
--

2.17.1

These structs are externally parsed -- we can't change the size of
pr_fname AFAICT.

Yes, they are parsed by crash utility and other tools.
I will keep pr_fname as-is.

-- 
Thanks
Yafang