torture: Avoid format string leak to thead name

Since the torture-test thread creation interface does not include
format string arguments, this commit makes sure the name can never be
accidentally processed as a format string.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>

diff --git a/kernel/torture.c b/kernel/torture.c
index 40bb511..d600af2 100644 (file)
--- a/kernel/torture.c
+++ b/kernel/torture.c
@@ -708,7 +708,7 @@ int _torture_create_kthread(int (*fn)(void *arg), void *arg, char *s, char *m,
        int ret = 0;
 
        VERBOSE_TOROUT_STRING(m);
-       *tp = kthread_run(fn, arg, s);
+       *tp = kthread_run(fn, arg, "%s", s);
        if (IS_ERR(*tp)) {
                ret = PTR_ERR(*tp);
                VERBOSE_TOROUT_ERRSTRING(f);