diff options
| author | Alexander Kuznetsov <wwfq@yandex-team.ru> | 2021-06-09 10:17:19 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-06-16 11:36:34 +0200 |
| commit | 0e3481c7efe99357df1b54615976594bdcd734f9 (patch) | |
| tree | f1583686573e50c716da4ca36a10b7fd14f82b7b /kernel | |
| parent | 9a27493e2ae218f2372da012745dcbf1ca5613ea (diff) | |
| download | linux-stable-0e3481c7efe99357df1b54615976594bdcd734f9.tar.gz linux-stable-0e3481c7efe99357df1b54615976594bdcd734f9.tar.bz2 linux-stable-0e3481c7efe99357df1b54615976594bdcd734f9.zip | |
cgroup1: don't allow '\n' in renaming
commit b7e24eb1caa5f8da20d405d262dba67943aedc42 upstream.
cgroup_mkdir() have restriction on newline usage in names:
$ mkdir $'/sys/fs/cgroup/cpu/test\ntest2'
mkdir: cannot create directory
'/sys/fs/cgroup/cpu/test\ntest2': Invalid argument
But in cgroup1_rename() such check is missed.
This allows us to make /proc/<pid>/cgroup unparsable:
$ mkdir /sys/fs/cgroup/cpu/test
$ mv /sys/fs/cgroup/cpu/test $'/sys/fs/cgroup/cpu/test\ntest2'
$ echo $$ > $'/sys/fs/cgroup/cpu/test\ntest2'
$ cat /proc/self/cgroup
11:pids:/
10:freezer:/
9:hugetlb:/
8:cpuset:/
7:blkio:/user.slice
6:memory:/user.slice
5:net_cls,net_prio:/
4:perf_event:/
3:devices:/user.slice
2:cpu,cpuacct:/test
test2
1:name=systemd:/
0::/
Signed-off-by: Alexander Kuznetsov <wwfq@yandex-team.ru>
Reported-by: Andrey Krasichkov <buglloc@yandex-team.ru>
Acked-by: Dmitry Yakunin <zeil@yandex-team.ru>
Cc: stable@vger.kernel.org
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/cgroup.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 3e0fca894a8b..3378c44e147e 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -3598,6 +3598,10 @@ static int cgroup_rename(struct kernfs_node *kn, struct kernfs_node *new_parent, struct cgroup *cgrp = kn->priv; int ret; + /* do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable */ + if (strchr(new_name_str, '\n')) + return -EINVAL; + if (kernfs_type(kn) != KERNFS_DIR) return -ENOTDIR; if (kn->parent != new_parent) |