I found a issue with some functions in /init/main.c of the linux kernel. They all involve the problem of the use of strcpy(I found that 3 functions use strcpy) . I thought maby this could lead to buffer overflow. Im not completely sure
__________________________________________________________________________________________________ main.c:ln 839,col 59 static void __init do_initcall_level(int level) { initcall_t *fn; strcpy(initcall_command_line, saved_command_line); parse_args(initcall_level_names[level], initcall_command_line, __start___param, __stop___param - __start___param, level, level, NULL, &repair_env_string); for (fn = initcall_levels[level]; fn < initcall_levels[level+1]; fn++) do_one_initcall(*fn); } __________________________________________________________________________________________________ line:ln 699,col 55 static int __init initcall_blacklist(char *str) { char *str_entry; struct blacklist_entry *entry; /* str argument is a comma-separated list of functions */ do { str_entry = strsep(&str, ","); if (str_entry) { pr_debug("blacklisting initcall %s\n", str_entry); entry = alloc_bootmem(sizeof(*entry)); entry->buf = alloc_bootmem(strlen(str_entry) + 1); strcpy(entry->buf, str_entry); list_add(&entry->next, &blacklisted_initcalls); } } while (str_entry); return 0; } ____________________________________________________________________________________________________________________________________________________ line:ln 368,ln 369,col 55, col 51 static void __init setup_command_line(char *command_line) { saved_command_line = memblock_virt_alloc(strlen(boot_command_line) + 1, 0); initcall_command_line = memblock_virt_alloc(strlen(boot_command_line) + 1, 0); static_command_line = memblock_virt_alloc(strlen(command_line) + 1, 0); strcpy(saved_command_line, boot_command_line); strcpy(static_command_line, command_line); }