Re: [PATCH 1/2] treewide: fix memory corruptions when TASK_COMM_LEN!= 16

[Andrew Morton]

On Sat, 21 Jan 2012 23:09:44 +0100
Jan Engelhardt <jengelh@xxxxxxxxxx> wrote:

> I found that the kernel BUG()s out, already during boot, when bumping
> TASK_COMM_LEN to a value larger than 16

We can never increase TASK_COMM_LEN - it is part of the kernel ABI/API.
Doing so would destroy existing userspace which uses 16-byte buffers.

> (and I can imagine the same
> problem unfolding as well if it is set to something smaller).

hm, that's a surprise.  Decreasing TASK_COMM_LEN is at least slightly
possible but it's hard to see why we should do so.

> Various places do insufficient length checks, simply assume certain
> sizes or hardcode things. Even though e.g. get_task_comm clearly
> documents that its buffer ought to be TASK_COMM_LEN long, I do believe
> that an extra size parameter, such as added in this patch, is a lot
> more robust than relying on callers getting the buffer size right.
> 
> With this patch, I no longer experience crashes, but that is not to
> say that there are not any further places (e.g. in modules I never
> use) with flakey ->comm handling.

You do seem to have found a few warts around the task->comm handling. 
But I don't believe that addressing them justifies adding new code
(adding another argument to get_task_comm).

If you're interested in working on this stuff I'd suggest that we
confine ourselves to cleaning things up (without adding code) rather
than permitting a different TASK_COMM_LEN.  Things like replacing "16"
with TASK_COMM_LEN.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/