* [PATCH iproute2] ss: bound fscanf width when reading comm in user_ent_hash_build_task
@ 2026-10-20 16:59 Prashanth Swaminathan
2026-10-20 18:06 ` Stephen Hemminger
0 siblings, 1 reply; 2+ messages in thread
From: Prashanth Swaminathan @ 2026-10-20 16:59 UTC (permalink / raw)
To: netdev; +Cc: stephen, dsahern, maze, yuyanghuang
user_ent_hash_build_task() reads the process comm name from
/proc/<pid>/stat into a 16-byte stack buffer (char name[16]) using an
unbounded fscanf("%*d (%[^)])", name).
Although the Linux kernel bounds the comm field to TASK_COMM_LEN - 1
(15) bytes, bound the conversion specifier to %15[^)] so a malformed
stat entry (e.g., via PROC_ROOT or non-standard procfs implementations)
cannot overflow the stack buffer.
Signed-off-by: Prashanth Swaminathan <prashanthsw@google.com>
---
misc/ss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/misc/ss.c b/misc/ss.c
index 26520cee..bc30d950 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -601,7 +601,7 @@ static void user_ent_hash_build_task(char *path,
int pid, int tid)
fp = fopen(stat, "r");
if (fp) {
- if (fscanf(fp, "%*d (%[^)])", name) == 1)
+ if (fscanf(fp, "%*d (%15[^)])", name) == 1)
escape_str(task, name, sizeof(task));
fclose(fp);
}
--
2.56.0.212.g129ede20d9-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH iproute2] ss: bound fscanf width when reading comm in user_ent_hash_build_task
2026-10-20 16:59 [PATCH iproute2] ss: bound fscanf width when reading comm in user_ent_hash_build_task Prashanth Swaminathan
@ 2026-10-20 18:06 ` Stephen Hemminger
0 siblings, 0 replies; 2+ messages in thread
From: Stephen Hemminger @ 2026-10-20 18:06 UTC (permalink / raw)
To: Prashanth Swaminathan; +Cc: netdev, dsahern, maze, yuyanghuang
On Tue, 20 Oct 2026 09:59:56 -0700
Prashanth Swaminathan <prashanthsw@google.com> wrote:
> user_ent_hash_build_task() reads the process comm name from
> /proc/<pid>/stat into a 16-byte stack buffer (char name[16]) using an
> unbounded fscanf("%*d (%[^)])", name).
>
> Although the Linux kernel bounds the comm field to TASK_COMM_LEN - 1
> (15) bytes, bound the conversion specifier to %15[^)] so a malformed
> stat entry (e.g., via PROC_ROOT or non-standard procfs implementations)
> cannot overflow the stack buffer.
>
> Signed-off-by: Prashanth Swaminathan <prashanthsw@google.com>
> ---
If you have a non-standard procfs, that is not our problem.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-20 18:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-20 16:59 [PATCH iproute2] ss: bound fscanf width when reading comm in user_ent_hash_build_task Prashanth Swaminathan
2026-10-20 18:06 ` Stephen Hemminger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox