The original code didn't leave enough space for a NULL terminator. These strings are copied with strcpy() into fixed length buffers in cgroup_root_from_opts().
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -1102,7 +1102,7 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts) · 1101 unmodified lines | ||
| 1102 | 1102 | if (opts->release_agent) |
| 1103 | 1103 | return -EINVAL; |
| 1104 | 1104 | opts->release_agent = |
| 1105 | − kstrndup(token + 14, PATH_MAX, GFP_KERNEL); | |
| 1105 | + kstrndup(token + 14, PATH_MAX - 1, GFP_KERNEL); | |
| 1106 | 1106 | if (!opts->release_agent) |
| 1107 | 1107 | return -ENOMEM; |
| 1108 | 1108 | } else if (!strncmp(token, "name=", 5)) { |
| @@ -1123,7 +1123,7 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts) · 14 unmodified lines | ||
| 1123 | 1123 | if (opts->name) |
| 1124 | 1124 | return -EINVAL; |
| 1125 | 1125 | opts->name = kstrndup(name, |
| 1126 | − MAX_CGROUP_ROOT_NAMELEN, | |
| 1126 | + MAX_CGROUP_ROOT_NAMELEN - 1, | |
| 1127 | 1127 | GFP_KERNEL); |
| 1128 | 1128 | if (!opts->name) |
| 1129 | 1129 | return -ENOMEM; |