2004-11-17 20:58:32

by Prasanna Meda

Subject: One more get_task_comm()

Looking at get_task_comm patch:
http://linus.bkbits.net:8080/linux-2.5/[email protected]

There is one other place where task->comm is accessed
outside current. There are two issues. The code is
trying to copy to temp space without task_lock. It is not
using temp space for actual user copy.

--- arch/mips/kernel/sysirix.c.saved Wed Nov 17 13:18:50 2004
+++ arch/mips/kernel/sysirix.c Wed Nov 17 13:29:11 2004
@@ -282,7 +282,7 @@
int pid = (int) regs->regs[base + 5];
char *buf = (char *) regs->regs[base + 6];
struct task_struct *p;
- char comm[16];
+ char comm[sizeof(current->comm)];

retval = verify_area(VERIFY_WRITE, buf, 16);
if (retval)
@@ -294,11 +294,11 @@
retval = -ESRCH;
break;
}
- memcpy(comm, p->comm, 16);
+ get_task_comm(comm, p);
read_unlock(&tasklist_lock);

/* XXX Need to check sizes. */
- copy_to_user(buf, p->comm, 16);
+ copy_to_user(buf, comm, 16);
retval = 0;
break;
}

Related questions:

2004-11-17 23:49:01

by Prasanna Meda

Subject: Re: One more get_task_comm()

Removing assumption of command length as 16 completely

--- arch/mips/kernel/sysirix.c.saved Wed Nov 17 13:18:50 2004
+++ arch/mips/kernel/sysirix.c Wed Nov 17 14:09:12 2004
@@ -282,9 +282,9 @@
int pid = (int) regs->regs[base + 5];
char *buf = (char *) regs->regs[base + 6];
struct task_struct *p;
- char comm[16];
+ char tcomm[sizeof(current->comm)];

- retval = verify_area(VERIFY_WRITE, buf, 16);
+ retval = verify_area(VERIFY_WRITE, buf, sizeof(tcomm));
if (retval)
break;
read_lock(&tasklist_lock);
@@ -294,11 +294,11 @@
retval = -ESRCH;
break;
}
- memcpy(comm, p->comm, 16);
+ get_task_comm(tcomm, p);
read_unlock(&tasklist_lock);

/* XXX Need to check sizes. */
- copy_to_user(buf, p->comm, 16);
+ copy_to_user(buf, tcomm, sizeof(tcomm));
retval = 0;
break;
}

2004-11-17 21:59:47

by Prasanna Meda

Subject: Re: One more get_task_comm()

Removing assumption of command length as 16 completely

--- arch/mips/kernel/sysirix.c.saved Wed Nov 17 13:18:50 2004
+++ arch/mips/kernel/sysirix.c Wed Nov 17 14:09:12 2004
@@ -282,9 +282,9 @@
int pid = (int) regs->regs[base + 5];
char *buf = (char *) regs->regs[base + 6];
struct task_struct *p;
- char comm[16];
+ char tcomm[sizeof(current->comm)];

- retval = verify_area(VERIFY_WRITE, buf, 16);
+ retval = verify_area(VERIFY_WRITE, buf, sizeof(tcomm));
if (retval)
break;
read_lock(&tasklist_lock);
@@ -294,11 +294,11 @@
retval = -ESRCH;
break;
}
- memcpy(comm, p->comm, 16);
+ get_task_comm(tcomm, p);
read_unlock(&tasklist_lock);

/* XXX Need to check sizes. */
- copy_to_user(buf, p->comm, 16);
+ copy_to_user(buf, tcomm, sizeof(tcomm));
retval = 0;
break;
}