The original code didn't leave enough space for a NULL terminator. These strings are copied with strcpy() into fixed length buffers in cgroup_root_from_opts().
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -1102,7 +1102,7 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts) · 1101 unmodified lines | |||
| 1102 | if (opts->release_agent) | 1102 | if (opts->release_agent) |
| 1103 | return -EINVAL; | 1103 | return -EINVAL; |
| 1104 | opts->release_agent = | 1104 | opts->release_agent = |
| 1105 | kstrndup(token + 14, PATH_MAX, GFP_KERNEL); | 1105 | kstrndup(token + 14, PATH_MAX - 1, GFP_KERNEL); |
| 1106 | if (!opts->release_agent) | 1106 | if (!opts->release_agent) |
| 1107 | return -ENOMEM; | 1107 | return -ENOMEM; |
| 1108 | } else if (!strncmp(token, "name=", 5)) { | 1108 | } else if (!strncmp(token, "name=", 5)) { |
| @@ -1123,7 +1123,7 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts) · 14 unmodified lines | |||
| 1123 | if (opts->name) | 1123 | if (opts->name) |
| 1124 | return -EINVAL; | 1124 | return -EINVAL; |
| 1125 | opts->name = kstrndup(name, | 1125 | opts->name = kstrndup(name, |
| 1126 | MAX_CGROUP_ROOT_NAMELEN, | 1126 | MAX_CGROUP_ROOT_NAMELEN - 1, |
| 1127 | GFP_KERNEL); | 1127 | GFP_KERNEL); |
| 1128 | if (!opts->name) | 1128 | if (!opts->name) |
| 1129 | return -ENOMEM; | 1129 | return -ENOMEM; |