Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Passing a pointer to `struct task_struct` instead of its `comm` field to `strscpy_pad()` leads to an incompatible pointer cast and a kernel memory info leak. --
commit 90523a0d5e26d2bcb762f02d00c73857b4ad6c5d Author: André Almeida <[email protected]> treewide: Get rid of get_task_comm() This commit replaces calls to get_task_comm() with strscpy_pad() across the tree. It aims to properly handle buffer padding and truncation depending on buffer sizes. Link: https://lore.kernel.org/lkml/CAHk-=wi5c=_-FBGo_88CowJd_F-Gi6Ud9d=talm65ren7yj...@mail.gmail.com/ [ ... ] > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > index 8e88ac65fd7fc..0e1aa2bb4a7ca 100644 > --- a/security/smack/smack_lsm.c > +++ b/security/smack/smack_lsm.c > @@ -138,6 +138,8 @@ smk_bu_tsk_to_obj(struct task_struct *tsk, const struct > task_smack *tsp, > char acc[SMK_NUM_ACCESS_TYPE + 1]; > char comm[TASK_COMM_LEN]; > > + strscpy_pad(comm, tsk); [Severity: High] Could this lead to a kernel memory info leak by passing the task_struct pointer instead of the process name string? strscpy_pad() expects a const char * as its second argument, but it receives a struct task_struct * here instead of tsk->comm. If this compiles (e.g., without -Werror), this copies up to 16 bytes starting at the base of the task_struct into the comm buffer. When this buffer is later printed via pr_info() during a Smack Bringup log, it dumps raw kernel memory to dmesg, which could be leveraged to bypass KASLR or read sensitive struct fields. > + > if (rc <= 0) > return rc; > if (rc > SMACK_UNCONFINED_OBJECT) > @@ -147,7 +149,7 @@ smk_bu_tsk_to_obj(struct task_struct *tsk, const struct > task_smack *tsp, > > pr_info("Smack %s: (%s %s %s) %s %s\n", smk_bu_mess[rc], > smk_of_task(tsp)->smk_known, oskp->smk_known, > - acc, get_task_comm(comm, tsk), note); > + acc, comm, note); > return 0; > #else > return rc; -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
