Messages in this thread | | | Date | Thu, 13 Jun 2013 00:31:58 +0100 | From | Djalal Harouni <> | Subject | Re: [PATCH 5/6] kthread: avoid parsing names as format strings |
| |
Hi Kees,
On Fri, Jun 07, 2013 at 04:50:54PM -0700, Kees Cook wrote: > Calling kthread_run with a single name parameter causes it to be handled > as a format string. Many callers are passing potentially dynamic string > content, so use "%s" in those cases to avoid any potential accidents. > > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > drivers/block/aoe/aoecmd.c | 2 +- > drivers/block/mtip32xx/mtip32xx.c | 3 ++- [...] > diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c > index 847107e..81ce4c0 100644 > --- a/drivers/block/mtip32xx/mtip32xx.c > +++ b/drivers/block/mtip32xx/mtip32xx.c > @@ -4085,7 +4085,8 @@ skip_create_disk: > start_service_thread: > sprintf(thd_name, "mtip_svc_thd_%02d", index); We can also save some bytes here, remove the sprintf() and thd_name[]
> dd->mtip_svc_handler = kthread_create_on_node(mtip_service_thread, > - dd, dd->numa_node, thd_name); > + dd, dd->numa_node, "%s", > + thd_name); > > if (IS_ERR(dd->mtip_svc_handler)) { > dev_err(&dd->pdev->dev, "service thread failed to start\n");
Thanks!
-- Djalal Harouni http://opendz.org
| |