From: Steven Rostedt <rostedt@goodmis.org>
To: Kassey Li <quic_yingangl@quicinc.com>
Cc: mingo@redhat.com, tj@kernel.org, william.kucharski@oracle.com,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2] cgroup: align the comm length with TASK_COMM_LEN
Date: Mon, 26 Sep 2022 10:09:33 -0400 [thread overview]
Message-ID: <20220926100933.4532f987@gandalf.local.home> (raw)
In-Reply-To: <20220923075105.28251-1-quic_yingangl@quicinc.com>
On Fri, 23 Sep 2022 15:51:05 +0800
Kassey Li <quic_yingangl@quicinc.com> wrote:
> __string could get a dst string with length less than
> TASK_COMM_LEN.
>
> A task->comm may change that can cause out of bounds access
> for the dst string buffer, e.g in the call trace of below:
>
> Call trace:
>
> dump_backtrace.cfi_jt+0x0/0x4
> show_stack+0x14/0x1c
> dump_stack+0xa0/0xd8
> die_callback+0x248/0x24c
> notify_die+0x7c/0xf8
> die+0xac/0x290
> die_kernel_fault+0x88/0x98
> die_kernel_fault+0x0/0x98
> do_page_fault+0xa0/0x544
> do_mem_abort+0x60/0x10c
> el1_da+0x1c/0xc4
> trace_event_raw_event_cgroup_migrate+0x124/0x170
You're sure the above is on the strcpy()?
Note, this code has __string() which does a strlen() which appears to be
working fine.
> cgroup_attach_task+0x2e8/0x41c
> __cgroup1_procs_write+0x114/0x1ec
> cgroup1_tasks_write+0x10/0x18
> cgroup_file_write+0xa4/0x208
> kernfs_fop_write+0x1f0/0x2f4
> __vfs_write+0x5c/0x200
> vfs_write+0xe0/0x1a0
> ksys_write+0x74/0xdc
> __arm64_sys_write+0x18/0x20
> el0_svc_common+0xc0/0x1a4
> el0_svc_compat_handler+0x18/0x20
> el0_svc_compat+0x8/0x2c
Can you give the full debug report, that includes the register content and
everything else.
-- Steve
next prev parent reply other threads:[~2022-09-26 15:22 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-23 7:51 Kassey Li
2022-09-23 15:00 ` Steven Rostedt
2022-09-26 2:18 ` Kassey Li
2022-09-26 2:42 ` Steven Rostedt
2022-09-26 11:08 ` Kassey Li
2022-09-26 14:09 ` Steven Rostedt [this message]
2022-09-27 1:32 ` Kassey Li
2022-09-28 7:35 ` Kassey Li
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220926100933.4532f987@gandalf.local.home \
--to=rostedt@goodmis.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=quic_yingangl@quicinc.com \
--cc=tj@kernel.org \
--cc=william.kucharski@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®