Commit f4a2589f authored Oct 27, 2010 by Evgeny Kuznetsov Committed by Linus Torvalds Oct 27, 2010

cgroups: add check for strcpy destination string overflow



Function "strcpy" is used without check for maximum allowed source string
length and could cause destination string overflow.  Check for string
length is added before using "strcpy".  Function now is return error if
source string length is more than a maximum.

akpm: presently considered NotABug, but add the check for general
future-safeness and robustness.

Signed-off-by: Evgeny Kuznetsov <EXT-Eugeny.Kuznetsov@nokia.com>
Acked-by: Paul Menage <menage@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 32a8cf23

kernel/cgroup.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -1922,6 +1922,8 @@ static int cgroup_release_agent_write(struct cgroup cgrp, struct cftype cft,
		const char *buffer)
		{
		BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
		if (strlen(buffer) >= PATH_MAX)
		return -EINVAL;
		if (!cgroup_lock_live_group(cgrp))
		return -ENODEV;
		strcpy(cgrp->root->release_agent_path, buffer);

Admin message