coredump: validate socket path in coredump_parse()

properly again. Someone might have modified the buffer concurrently.

Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-7-315c0c34ba94@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/fs/coredump.c b/fs/coredump.c
index 8437bdc26d081777ebc642e0f7ee66573c560a43..52efd1b342615f14b1128feb99da3d689953454a 100644 (file)
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -296,6 +296,17 @@ static bool coredump_parse(struct core_name *cn, struct coredump_params *cprm,
                        return false;
                }
 
+               /* Must not contain ".." in the path. */
+               if (name_contains_dotdot(cn->corename)) {
+                       coredump_report_failure("Coredump socket may not %s contain '..' spaces", cn->corename);
+                       return false;
+               }
+
+               if (strlen(cn->corename) >= UNIX_PATH_MAX) {
+                       coredump_report_failure("Coredump socket path %s too long", cn->corename);
+                       return false;
+               }
+
                /*
                 * Currently no need to parse any other options.
                 * Relevant information can be retrieved from the peer