Commit 046667c4 authored Jul 21, 2024 by Al Viro

memcg_write_event_control(): fix a user-triggerable oops

we are *not* guaranteed that anything past the terminating NUL
is mapped (let alone initialized with anything sane).

Fixes: 0dea1168 ("cgroup: implement eventfd-based generic API for notifications")
Cc: stable@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

parent 9a2fa147

mm/memcontrol-v1.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -1842,9 +1842,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
		buf = endp + 1;

		cfd = simple_strtoul(buf, &endp, 10);
		if ((endp != ' ') && (endp != '\0'))
		return -EINVAL;
		if (*endp == '\0')
		buf = endp;
		else if (*endp == ' ')
		buf = endp + 1;
		else
		return -EINVAL;

		event = kzalloc(sizeof(*event), GFP_KERNEL);
		if (!event)