From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 20 Jan 2025 21:27:58 +0000 (-0800)
Subject: Merge tag 'execve-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees... 
X-Git-Tag: v6.14-rc1~206
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fadc3ed9ce1cd9ecc5c8be8875f7ec11ab3a7ebe;p=thirdparty%2Fkernel%2Flinux.git

Merge tag 'execve-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull execve updates from Kees Cook:

 - fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case (Tycho
   Andersen, Kees Cook)

 - binfmt_misc: Fix comment typos (Christophe JAILLET)

 - move empty argv[0] warning closer to actual logic (Nir Lichtman)

 - remove legacy custom binfmt modules autoloading (Nir Lichtman)

 - Make sure set_task_comm() always NUL-terminates

 - binfmt_flat: Fix integer overflow bug on 32 bit systems (Dan
   Carpenter)

 - coredump: Do not lock when copying "comm"

 - MAINTAINERS: add auxvec.h and set myself as maintainer

* tag 'execve-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  binfmt_flat: Fix integer overflow bug on 32 bit systems
  selftests/exec: add a test for execveat()'s comm
  exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
  exec: Make sure task->comm is always NUL-terminated
  exec: remove legacy custom binfmt modules autoloading
  exec: move warning of null argv to be next to the relevant code
  fs: binfmt: Fix a typo
  MAINTAINERS: exec: Mark Kees as maintainer
  MAINTAINERS: exec: Add auxvec.h UAPI
  coredump: Do not lock during 'comm' reporting
---

fadc3ed9ce1cd9ecc5c8be8875f7ec11ab3a7ebe
diff --cc fs/exec.c
index 98cb7ba9983c7,1843366be6ffd..2f0acef8908e5
--- a/fs/exec.c
+++ b/fs/exec.c
@@@ -1193,17 -1189,27 +1193,17 @@@ static int unshare_sighand(struct task_
  	return 0;
  }
  
 -char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
 -{
 -	task_lock(tsk);
 -	/* Always NUL terminated and zero-padded */
 -	strscpy_pad(buf, tsk->comm, buf_size);
 -	task_unlock(tsk);
 -	return buf;
 -}
 -EXPORT_SYMBOL_GPL(__get_task_comm);
 -
  /*
-  * These functions flushes out all traces of the currently running executable
-  * so that a new one can be started
+  * This is unlocked -- the string will always be NUL-terminated, but
+  * may show overlapping contents if racing concurrent reads.
   */
- 
  void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec)
  {
- 	task_lock(tsk);
+ 	size_t len = min(strlen(buf), sizeof(tsk->comm) - 1);
+ 
  	trace_task_rename(tsk, buf);
- 	strscpy_pad(tsk->comm, buf, sizeof(tsk->comm));
- 	task_unlock(tsk);
+ 	memcpy(tsk->comm, buf, len);
+ 	memset(&tsk->comm[len], 0, sizeof(tsk->comm) - len);
  	perf_event_comm(tsk, exec);
  }
  
diff --cc include/linux/sched.h
index 64934e0830af3,ac9f429ddc178..3c7eb16ab1d52
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@@ -1944,29 -1932,15 +1944,28 @@@ static inline void kick_process(struct 
  #endif
  
  extern void __set_task_comm(struct task_struct *tsk, const char *from, bool exec);
- 
- static inline void set_task_comm(struct task_struct *tsk, const char *from)
- {
- 	__set_task_comm(tsk, from, false);
- }
+ #define set_task_comm(tsk, from) ({			\
+ 	BUILD_BUG_ON(sizeof(from) != TASK_COMM_LEN);	\
+ 	__set_task_comm(tsk, from, false);		\
+ })
  
 -extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk);
 +/*
 + * - Why not use task_lock()?
 + *   User space can randomly change their names anyway, so locking for readers
 + *   doesn't make sense. For writers, locking is probably necessary, as a race
 + *   condition could lead to long-term mixed results.
 + *   The strscpy_pad() in __set_task_comm() can ensure that the task comm is
 + *   always NUL-terminated and zero-padded. Therefore the race condition between
 + *   reader and writer is not an issue.
 + *
 + * - BUILD_BUG_ON() can help prevent the buf from being truncated.
 + *   Since the callers don't perform any return value checks, this safeguard is
 + *   necessary.
 + */
  #define get_task_comm(buf, tsk) ({			\
 -	BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN);	\
 -	__get_task_comm(buf, sizeof(buf), tsk);		\
 +	BUILD_BUG_ON(sizeof(buf) < TASK_COMM_LEN);	\
 +	strscpy_pad(buf, (tsk)->comm);			\
 +	buf;						\
  })
  
  #ifdef CONFIG_SMP