diff options
author | Kees Cook <keescook@chromium.org> | 2023-12-12 13:17:39 -0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-12-15 17:25:10 +0100 |
commit | 5b56bf5cdb8b7c989055fe4d73fe3f409427d1d5 (patch) | |
tree | 8c1a0cf48db40987b64c8cbe10b76b622e34eb2b /kernel/cgroup | |
parent | 792e04768efbf2a1b49a7162a9fa06c1fa584723 (diff) | |
download | linux-5b56bf5cdb8b7c989055fe4d73fe3f409427d1d5.tar.gz linux-5b56bf5cdb8b7c989055fe4d73fe3f409427d1d5.tar.bz2 linux-5b56bf5cdb8b7c989055fe4d73fe3f409427d1d5.zip |
kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy()
strlcpy() reads the entire source buffer first. This read may exceed
the destination size limit. This is both inefficient and can lead
to linear read overflows if a source string is not NUL-terminated[1].
Additionally, it returns the size of the source string, not the
resulting size of the destination string. In an effort to remove strlcpy()
completely[2], replace strlcpy() here with strscpy().
Nothing actually checks the return value coming from kernfs_name_locked(),
so this has no impact on error paths. The caller hierarchy is:
kernfs_name_locked()
kernfs_name()
pr_cont_kernfs_name()
return value ignored
cgroup_name()
current_css_set_cg_links_read()
return value ignored
print_page_owner_memcg()
return value ignored
Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [1]
Link: https://github.com/KSPP/linux/issues/89 [2]
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Azeem Shaikh <azeemshaikh38@gmail.com>
Link: https://lore.kernel.org/r/20231116192127.1558276-2-keescook@chromium.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20231212211741.164376-2-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel/cgroup')
0 files changed, 0 insertions, 0 deletions