summaryrefslogtreecommitdiffstats
path: root/kernel/cgroup
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2023-12-12 13:17:39 -0800
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2023-12-15 17:25:10 +0100
commit5b56bf5cdb8b7c989055fe4d73fe3f409427d1d5 (patch)
tree8c1a0cf48db40987b64c8cbe10b76b622e34eb2b /kernel/cgroup
parent792e04768efbf2a1b49a7162a9fa06c1fa584723 (diff)
downloadlinux-5b56bf5cdb8b7c989055fe4d73fe3f409427d1d5.tar.gz
linux-5b56bf5cdb8b7c989055fe4d73fe3f409427d1d5.tar.bz2
linux-5b56bf5cdb8b7c989055fe4d73fe3f409427d1d5.zip
kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy()
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated[1]. Additionally, it returns the size of the source string, not the resulting size of the destination string. In an effort to remove strlcpy() completely[2], replace strlcpy() here with strscpy(). Nothing actually checks the return value coming from kernfs_name_locked(), so this has no impact on error paths. The caller hierarchy is: kernfs_name_locked() kernfs_name() pr_cont_kernfs_name() return value ignored cgroup_name() current_css_set_cg_links_read() return value ignored print_page_owner_memcg() return value ignored Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [1] Link: https://github.com/KSPP/linux/issues/89 [2] Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Tejun Heo <tj@kernel.org> Cc: Azeem Shaikh <azeemshaikh38@gmail.com> Link: https://lore.kernel.org/r/20231116192127.1558276-2-keescook@chromium.org Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20231212211741.164376-2-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel/cgroup')
0 files changed, 0 insertions, 0 deletions