Files
Alexandre SIMON fed286bde4 printk: fix buffer overflow when calling log_prefix function from call_console_drivers
This patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling
log_prefix() function from call_console_drivers().

This bug existed in previous releases but has been revealed with commit
162a7e7500 (2.6.39 => 3.0) that made changes
about how to allocate memory for early printk buffer (use of memblock_alloc).
It disappears with commit 7ff9554bb5 (3.4 => 3.5)
that does a refactoring of printk buffer management.

In log_prefix(), the access to "p[0]", "p[1]", "p[2]" or
"simple_strtoul(&p[1], &endp, 10)" may cause a buffer overflow as this
function is called from call_console_drivers by passing "&LOG_BUF(cur_index)"
where the index must be masked to do not exceed the buffer's boundary.

The trick is to prepare in call_console_drivers() a buffer with the necessary
data (PRI field of syslog message) to be safely evaluated in log_prefix().

This patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.

Without this patch, one can freeze a server running this loop from shell :
  $ export DUMMY=`cat /dev/urandom | tr -dc '12345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn' | head -c255`
  $ while true do ; echo $DUMMY > /dev/kmsg ; done

The "server freeze" depends on where memblock_alloc does allocate printk buffer :
if the buffer overflow is inside another kernel allocation the problem may not
be revealed, else the server may hangs up.

Signed-off-by: Alexandre SIMON <Alexandre.Simon@univ-lorraine.fr>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2013-02-06 04:33:57 +00:00
..
2012-11-16 16:46:48 +00:00
2011-10-26 15:43:25 -04:00
2011-11-16 09:21:50 +01:00
2012-02-20 12:46:20 -08:00
2012-08-02 14:37:54 +01:00
2011-09-27 09:25:02 +01:00
2011-11-07 23:54:53 +01:00
2011-10-31 20:19:04 +00:00
2012-02-29 16:31:24 -08:00
2013-01-03 03:32:57 +00:00
2011-11-23 11:33:07 +01:00
2012-08-10 00:11:14 +01:00
2011-09-27 18:08:04 +02:00
2012-07-25 04:11:19 +01:00
2012-04-02 09:52:34 -07:00
2012-10-10 03:30:45 +01:00
2013-01-03 03:32:54 +00:00
2011-11-02 16:06:57 -07:00
2011-10-31 14:03:22 +01:00
2012-01-25 16:13:17 -08:00
2012-02-06 09:41:06 -08:00
2011-11-22 16:37:01 -05:00
2011-11-02 16:07:02 -07:00
2012-08-10 00:11:14 +01:00
2011-11-29 11:59:50 +00:00
2012-07-25 04:11:40 +01:00
2013-01-16 01:13:25 +00:00
2012-07-12 04:31:59 +01:00
2011-10-31 17:30:47 -07:00
2011-10-31 17:30:44 -07:00
2011-11-02 16:07:02 -07:00
2011-10-03 14:01:21 -04:00
2012-07-25 04:11:32 +01:00
2011-11-02 16:07:02 -07:00