diff options
author | Pavel Begunkov <asml.silence@gmail.com> | 2021-04-01 11:55:04 +0300 |
---|---|---|
committer | Jens Axboe <axboe@kernel.dk> | 2021-04-01 18:21:18 +0300 |
commit | 696ee88a7c50f96573f98aa76cc74286033140c1 (patch) | |
tree | b215f2544b7f3c95374a7a1ebaa85262296d05e5 /fs/io_uring.c | |
parent | 4b982bd0f383db9132e892c0c5144117359a6289 (diff) | |
download | linux-696ee88a7c50f96573f98aa76cc74286033140c1.tar.xz |
io_uring/io-wq: protect against sprintf overflow
task_pid may be large enough to not fit into the left space of
TASK_COMM_LEN-sized buffers and overflow in sprintf. We not so care
about uniqueness, so replace it with safer snprintf().
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/1702c6145d7e1c46fbc382f28334c02e1a3d3994.1617267273.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs/io_uring.c')
-rw-r--r-- | fs/io_uring.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index a16b7df934d1..4a6701b5065e 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -6718,7 +6718,7 @@ static int io_sq_thread(void *data) char buf[TASK_COMM_LEN]; DEFINE_WAIT(wait); - sprintf(buf, "iou-sqp-%d", sqd->task_pid); + snprintf(buf, sizeof(buf), "iou-sqp-%d", sqd->task_pid); set_task_comm(current, buf); current->pf_io_worker = NULL; |