Skip to content

Commit

Permalink
cgroups: add check for strcpy destination string overflow
Browse files Browse the repository at this point in the history
Function "strcpy" is used without check for maximum allowed source string
length and could cause destination string overflow.  Check for string
length is added before using "strcpy".  Function now is return error if
source string length is more than a maximum.

akpm: presently considered NotABug, but add the check for general
future-safeness and robustness.

Signed-off-by: Evgeny Kuznetsov <EXT-Eugeny.Kuznetsov@nokia.com>
Acked-by: Paul Menage <menage@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  • Loading branch information
Evgeny Kuznetsov authored and torvalds committed Oct 28, 2010
1 parent 32a8cf2 commit f4a2589
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions kernel/cgroup.c
Expand Up @@ -1922,6 +1922,8 @@ static int cgroup_release_agent_write(struct cgroup *cgrp, struct cftype *cft,
const char *buffer)
{
BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
if (strlen(buffer) >= PATH_MAX)
return -EINVAL;
if (!cgroup_lock_live_group(cgrp))
return -ENODEV;
strcpy(cgrp->root->release_agent_path, buffer);
Expand Down

0 comments on commit f4a2589

Please sign in to comment.