Alexandre SIMON ce0030c00f printk: fix buffer overflow when calling log_prefix function from call_console_drivers ... This patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling log_prefix() function from call_console_drivers(). This bug existed in previous releases but has been revealed with commit 162a7e7500 (2.6.39 => 3.0) that made changes about how to allocate memory for early printk buffer (use of memblock_alloc). It disappears with commit 7ff9554bb5 (3.4 => 3.5) that does a refactoring of printk buffer management. In log_prefix(), the access to "p[0]", "p[1]", "p[2]" or "simple_strtoul(&p[1], &endp, 10)" may cause a buffer overflow as this function is called from call_console_drivers by passing "&LOG_BUF(cur_index)" where the index must be masked to do not exceed the buffer's boundary. The trick is to prepare in call_console_drivers() a buffer with the necessary data (PRI field of syslog message) to be safely evaluated in log_prefix(). This patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y. Without this patch, one can freeze a server running this loop from shell : $ export DUMMY=`cat /dev/urandom | tr -dc '12345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn' | head -c255` $ while true do ; echo $DUMMY > /dev/kmsg ; done The "server freeze" depends on where memblock_alloc does allocate printk buffer : if the buffer overflow is inside another kernel allocation the problem may not be revealed, else the server may hangs up. Signed-off-by: Alexandre SIMON <Alexandre.Simon@univ-lorraine.fr> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2013-02-21 10:04:57 -08:00
..
acpi	Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux	2012-05-05 10:06:06 -07:00
asm-generic	mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT	2013-01-11 09:07:18 -08:00
crypto	crypto: user - Fix lookup of algorithms with IV generator	2012-03-29 19:52:47 +08:00
drm	drm/radeon: add new SI pci id	2012-12-03 11:47:01 -08:00
keys
linux	printk: fix buffer overflow when calling log_prefix function from call_console_drivers	2013-02-21 10:04:57 -08:00
math-emu
media	Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media	2012-05-14 11:23:37 -07:00
misc
mtd
net	tcp: implement RFC 5961 3.2	2013-01-11 09:07:14 -08:00
pcmcia
rdma	infiniband: pass rdma_cm module to netlink_dump_start	2012-10-28 10:14:15 -07:00
rxrpc
scsi	SCSI: libsas: fix taskfile corruption in sas_ata_qc_fill_rtf	2012-07-16 09:04:37 -07:00
sound	ALSA: Add a reference counter to card instance	2012-11-17 13:16:13 -08:00
target	target: Add link_magic for fabric allow_link destination target_items	2013-01-21 11:45:24 -08:00
trace	xen/mmu: Use Xen specific TLB flush instead of the generic one.	2012-11-17 13:15:54 -08:00
video	Merge branch 'platforms' of git://git.linaro.org/people/rmk/linux-arm	2012-03-27 18:17:02 -07:00
xen	xen/m2p: do not reuse kmap_op->dev_bus_addr	2012-10-02 10:30:06 -07:00
Kbuild