From: Amey Telawane <[email protected]> Strcpy has no limit on string being copied which causes stack corruption leading to kernel panic. Use strlcpy to resolve the issue by providing length of string to be copied.
Cc: [email protected] Signed-off-by: Amey Telawane <[email protected]> [AmitP: Cherry-picked this commit from CodeAurora kernel/msm-3.10 https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=2161ae9a70b12cf18ac8e5952a20161ffbccb477] Signed-off-by: Amit Pundir <[email protected]> --- This patch featured in Android Security Bulletin for May 2017, https://source.android.com/security/bulletin/2017-05-01#eop-in-kernel-trace-subsystem, but it is not upstreamed yet and I couldn't find any previous upstream submission as well. kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index bd8fb5cfda4d..b227e141e1f1 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -1976,7 +1976,7 @@ static void __trace_find_cmdline(int pid, char comm[]) map = savedcmd->map_pid_to_cmdline[pid]; if (map != NO_CMDLINE_MAP) - strcpy(comm, get_saved_cmdlines(map)); + strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN - 1); else strcpy(comm, "<...>"); } -- 2.7.4
