Commit b7e24eb1 authored by Alexander Kuznetsov's avatar Alexander Kuznetsov Committed by Tejun Heo

cgroup1: don't allow '\n' in renaming

cgroup_mkdir() have restriction on newline usage in names:
$ mkdir $'/sys/fs/cgroup/cpu/test\ntest2'
mkdir: cannot create directory
'/sys/fs/cgroup/cpu/test\ntest2': Invalid argument

But in cgroup1_rename() such check is missed.
This allows us to make /proc/<pid>/cgroup unparsable:
$ mkdir /sys/fs/cgroup/cpu/test
$ mv /sys/fs/cgroup/cpu/test $'/sys/fs/cgroup/cpu/test\ntest2'
$ echo $$ > $'/sys/fs/cgroup/cpu/test\ntest2'
$ cat /proc/self/cgroup
11:pids:/
10:freezer:/
9:hugetlb:/
8:cpuset:/
7:blkio:/user.slice
6:memory:/user.slice
5:net_cls,net_prio:/
4:perf_event:/
3:devices:/user.slice
2:cpu,cpuacct:/test
test2
1:name=systemd:/
0::/
Signed-off-by: default avatarAlexander Kuznetsov <wwfq@yandex-team.ru>
Reported-by: default avatarAndrey Krasichkov <buglloc@yandex-team.ru>
Acked-by: default avatarDmitry Yakunin <zeil@yandex-team.ru>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent 08b2b6fd
...@@ -820,6 +820,10 @@ static int cgroup1_rename(struct kernfs_node *kn, struct kernfs_node *new_parent ...@@ -820,6 +820,10 @@ static int cgroup1_rename(struct kernfs_node *kn, struct kernfs_node *new_parent
struct cgroup *cgrp = kn->priv; struct cgroup *cgrp = kn->priv;
int ret; int ret;
/* do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable */
if (strchr(new_name_str, '\n'))
return -EINVAL;
if (kernfs_type(kn) != KERNFS_DIR) if (kernfs_type(kn) != KERNFS_DIR)
return -ENOTDIR; return -ENOTDIR;
if (kn->parent != new_parent) if (kn->parent != new_parent)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment