diff options
| author | Christian Brauner <brauner@kernel.org> | 2025-06-12 15:25:21 +0200 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-06-16 17:01:22 +0200 |
| commit | 6dfc06d328b70af22c577bb908c97f8841b9f4fc (patch) | |
| tree | d728d4b9c99b036af825d99b7fcdfa0d93ecca0f | |
| parent | edfe3bdbbb52339cd8c2366402f2702c5ebc15c7 (diff) | |
coredump: validate socket path in coredump_parse()
properly again. Someone might have modified the buffer concurrently.
Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-7-315c0c34ba94@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
| -rw-r--r-- | fs/coredump.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/fs/coredump.c b/fs/coredump.c index 8437bdc26d08..52efd1b34261 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -296,6 +296,17 @@ static bool coredump_parse(struct core_name *cn, struct coredump_params *cprm, return false; } + /* Must not contain ".." in the path. */ + if (name_contains_dotdot(cn->corename)) { + coredump_report_failure("Coredump socket may not %s contain '..' spaces", cn->corename); + return false; + } + + if (strlen(cn->corename) >= UNIX_PATH_MAX) { + coredump_report_failure("Coredump socket path %s too long", cn->corename); + return false; + } + /* * Currently no need to parse any other options. * Relevant information can be retrieved from the peer |