[RFC PATCH 05/10] io-wq: protect against future set_task_comm() overflows.

[Stefan Metzmacher <metze@samba.org>]

Signed-off-by: Stefan Metzmacher <metze@samba.org>
---
 fs/io-wq.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/fs/io-wq.c b/fs/io-wq.c
index d6b15a627f9a..5c7d2a8c112e 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -588,7 +588,19 @@ static bool create_io_worker(struct io_wq *wq, struct io_wqe *wqe, int index)
 		return false;
 	}
 
-	sprintf(tsk_comm, "iou-wrk-%d", wq->task_pid);
+	/*
+	 * The limit value of pid_max_max/PID_MAX_LIMIT
+	 * is 4 * 1024 * 1024 = 4194304.
+	 *
+	 * TASK_COMM_LEN is 16, so we have 15 chars to fill.
+	 *
+	 * With "iou-wrk-4194304" we just fit into 15 chars.
+	 * If that ever changes we may better add some special
+	 * handling for PF_IO_WORKER in proc_task_name(), as that
+	 * allows up to 63 chars.
+	 */
+	WARN_ON(snprintf(tsk_comm, sizeof(tsk_comm),
+			 "iou-wrk-%d", wq->task_pid) >= sizeof(tsk_comm));
 	set_task_comm(tsk, tsk_comm);
 
 	tsk->pf_io_worker = worker;
@@ -780,7 +792,19 @@ static int io_wq_fork_manager(struct io_wq *wq)
 	if (!IS_ERR(tsk)) {
 		char tsk_comm[TASK_COMM_LEN];
 
-		sprintf(tsk_comm, "iou-mgr-%d", wq->task_pid);
+		/*
+		 * The limit value of pid_max_max/PID_MAX_LIMIT
+		 * is 4 * 1024 * 1024 = 4194304.
+		 *
+		 * TASK_COMM_LEN is 16, so we have 15 chars to fill.
+		 *
+		 * With "iou-mgr-4194304" we just fit into 15 chars.
+		 * If that ever changes we may better add some special
+		 * handling for PF_IO_WORKER in proc_task_name(), as that
+		 * allows up to 63 chars.
+		 */
+		WARN_ON(snprintf(tsk_comm, sizeof(tsk_comm),
+				 "iou-mgr-%d", wq->task_pid) >= sizeof(tsk_comm));
 		set_task_comm(tsk, tsk_comm);
 
 		wq->manager = get_task_struct(tsk);
-- 
2.25.1