public inbox for [email protected]
 help / color / mirror / Atom feed
* [PATCH 5.12] io_uring/io-wq: protect against sprintf overflow
@ 2021-04-01  8:55 Pavel Begunkov
  2021-04-01 15:21 ` Jens Axboe
  0 siblings, 1 reply; 2+ messages in thread
From: Pavel Begunkov @ 2021-04-01  8:55 UTC (permalink / raw)
  To: Jens Axboe, io-uring; +Cc: Alexey Dobriyan

task_pid may be large enough to not fit into the left space of
TASK_COMM_LEN-sized buffers and overflow in sprintf. We not so care
about uniqueness, so replace it with safer snprintf().

Reported-by: Alexey Dobriyan <[email protected]>
Signed-off-by: Pavel Begunkov <[email protected]>
---
 fs/io-wq.c    | 4 ++--
 fs/io_uring.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/io-wq.c b/fs/io-wq.c
index 45771bc06651..8dc200fafc79 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -509,7 +509,7 @@ static int io_wqe_worker(void *data)
 	worker->flags |= (IO_WORKER_F_UP | IO_WORKER_F_RUNNING);
 	io_wqe_inc_running(worker);
 
-	sprintf(buf, "iou-wrk-%d", wq->task_pid);
+	snprintf(buf, sizeof(buf), "iou-wrk-%d", wq->task_pid);
 	set_task_comm(current, buf);
 
 	while (!test_bit(IO_WQ_BIT_EXIT, &wq->state)) {
@@ -742,7 +742,7 @@ static int io_wq_manager(void *data)
 	char buf[TASK_COMM_LEN];
 	int node;
 
-	sprintf(buf, "iou-mgr-%d", wq->task_pid);
+	snprintf(buf, sizeof(buf), "iou-mgr-%d", wq->task_pid);
 	set_task_comm(current, buf);
 
 	do {
diff --git a/fs/io_uring.c b/fs/io_uring.c
index cc018402ab07..c8ceb5ef66a7 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6718,7 +6718,7 @@ static int io_sq_thread(void *data)
 	char buf[TASK_COMM_LEN];
 	DEFINE_WAIT(wait);
 
-	sprintf(buf, "iou-sqp-%d", sqd->task_pid);
+	snprintf(buf, sizeof(buf), "iou-sqp-%d", sqd->task_pid);
 	set_task_comm(current, buf);
 	current->pf_io_worker = NULL;
 
-- 
2.24.0


^ permalink raw reply related	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-04-01 17:48 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-04-01  8:55 [PATCH 5.12] io_uring/io-wq: protect against sprintf overflow Pavel Begunkov
2021-04-01 15:21 ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox