Files
ubports_kernel_google_msm/include/linux
Alexandre SIMON b2a127bf8c printk: fix buffer overflow when calling log_prefix function from call_console_drivers
This patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling
log_prefix() function from call_console_drivers().

This bug existed in previous releases but has been revealed with commit
162a7e7500 (2.6.39 => 3.0) that made changes
about how to allocate memory for early printk buffer (use of memblock_alloc).
It disappears with commit 7ff9554bb578ba02166071d2d487b7fc7d860d62 (3.4 => 3.5)
that does a refactoring of printk buffer management.

In log_prefix(), the access to "p[0]", "p[1]", "p[2]" or
"simple_strtoul(&p[1], &endp, 10)" may cause a buffer overflow as this
function is called from call_console_drivers by passing "&LOG_BUF(cur_index)"
where the index must be masked to do not exceed the buffer's boundary.

The trick is to prepare in call_console_drivers() a buffer with the necessary
data (PRI field of syslog message) to be safely evaluated in log_prefix().

This patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.

Without this patch, one can freeze a server running this loop from shell :
  $ export DUMMY=`cat /dev/urandom | tr -dc '12345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn' | head -c255`
  $ while true do ; echo $DUMMY > /dev/kmsg ; done

The "server freeze" depends on where memblock_alloc does allocate printk buffer :
if the buffer overflow is inside another kernel allocation the problem may not
be revealed, else the server may hangs up.

Signed-off-by: Alexandre SIMON <Alexandre.Simon@univ-lorraine.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-04-18 16:09:23 -07:00
..
2013-03-15 17:05:25 -07:00
2012-04-23 14:23:32 +03:00
2013-04-18 16:07:51 -07:00
2012-04-27 11:03:38 -06:00
2012-04-09 13:57:51 -07:00
2013-02-27 18:13:43 -08:00
2012-03-20 21:29:46 -04:00
2012-03-16 20:35:02 +00:00
2012-03-16 20:35:02 +00:00
2013-02-25 11:29:27 -08:00
2012-02-28 16:02:54 +01:00
2012-01-03 22:54:57 -05:00
2012-04-09 13:57:52 -07:00
2012-03-29 15:38:31 +10:30
2012-03-23 16:58:38 -07:00
2013-02-25 11:29:22 -08:00
2011-12-13 09:26:45 +00:00
2012-03-20 21:29:37 -04:00
2012-03-20 21:29:53 -04:00
2013-02-20 02:50:23 -08:00
2012-02-20 19:46:36 +11:00
2012-01-04 08:56:31 -06:00
2012-05-22 14:01:06 -07:00
2013-02-20 01:31:50 -08:00
2011-11-26 14:59:39 -05:00
2012-04-30 15:30:18 -07:00
2011-12-11 18:25:16 -05:00
2012-01-12 20:13:04 -08:00
2013-03-04 12:44:09 -08:00
2013-02-20 02:50:20 -08:00
2012-04-12 12:57:08 +02:00
2013-03-15 17:08:42 -07:00
2012-02-28 17:10:21 +00:00
2012-04-09 13:53:16 -07:00
2012-04-27 10:46:45 +08:00
2012-04-09 13:57:58 -07:00
2013-03-15 17:08:42 -07:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-26 21:47:19 +02:00
2012-03-27 22:45:26 -04:00
2013-02-08 15:04:34 -08:00
2012-01-03 22:55:17 -05:00
2013-02-27 18:13:08 -08:00
2012-01-09 13:52:09 +01:00
2012-03-08 10:50:35 -08:00
2012-03-21 17:54:57 -07:00
2012-03-08 10:50:35 -08:00
2012-01-17 15:40:51 -08:00
2011-12-27 11:26:41 +02:00
2012-03-15 21:41:34 +01:00
2012-03-03 15:04:45 -05:00
2013-03-15 17:08:42 -07:00
2013-02-25 11:29:50 -08:00
2013-03-15 17:24:49 -07:00
2013-04-18 16:09:22 -07:00
2012-03-05 15:26:47 -05:00
2012-03-21 17:54:58 -07:00
2012-03-21 17:55:01 -07:00
2012-01-06 12:10:26 -08:00
2012-03-16 21:49:24 +01:00
2011-12-13 09:26:45 +00:00
2013-02-25 11:29:28 -08:00
2012-03-20 21:29:38 -04:00
2013-02-27 18:16:43 -08:00
2012-01-03 22:55:07 -05:00
2012-03-28 18:30:03 +01:00
2012-03-08 11:38:50 -08:00
2012-03-12 22:19:13 +01:00
2012-01-09 09:33:57 +09:00
2012-05-01 09:40:19 -04:00
2012-03-06 11:01:33 +02:00
2012-03-19 16:53:08 -04:00
2011-12-13 09:26:45 +00:00
2012-05-16 13:27:23 -07:00
2013-02-25 11:29:18 -08:00
2012-01-03 22:54:56 -05:00
2012-03-22 19:43:43 -07:00
2012-04-10 22:39:17 -06:00
2013-03-04 12:45:08 -08:00
2013-03-15 17:07:24 -07:00
2012-04-11 09:36:00 +01:00
2012-03-08 10:50:35 -08:00
2013-02-20 02:50:29 -08:00
2013-02-25 11:29:50 -08:00