On Mon 16-12-24 14:45:15, Kees Cook wrote: > Since we have already allocated "len + 1" space for event->name, make sure > that name->name cannot ever accidentally cause a copy overflow by calling > strscpy() instead of the unbounded strcpy() routine. This assists in > the ongoing efforts to remove the unsafe strcpy() API[1] from the kernel. > > Link: https://github.com/KSPP/linux/issues/88 [1] > Signed-off-by: Kees Cook <kees@xxxxxxxxxx> Thanks. Added to my tree. Honza > --- > Cc: Jan Kara <jack@xxxxxxx> > Cc: Amir Goldstein <amir73il@xxxxxxxxx> > Cc: linux-fsdevel@xxxxxxxxxxxxxxx > --- > fs/notify/inotify/inotify_fsnotify.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c > index 993375f0db67..cd7d11b0eb08 100644 > --- a/fs/notify/inotify/inotify_fsnotify.c > +++ b/fs/notify/inotify/inotify_fsnotify.c > @@ -121,7 +121,7 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask, > event->sync_cookie = cookie; > event->name_len = len; > if (len) > - strcpy(event->name, name->name); > + strscpy(event->name, name->name, event->name_len + 1); > > ret = fsnotify_add_event(group, fsn_event, inotify_merge); > if (ret) { > -- > 2.34.1 > -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR
