releases/3.6.8/pstore-fix-null-pointer-dereference-in-console-writes.patch

   1 From 70a6f46d7b0ec03653b9ab3f8063a9717a4a53ef Mon Sep 17 00:00:00 2001
   2 From: Colin Ian King <colin.king@canonical.com>
   3 Date: Wed, 14 Nov 2012 11:49:53 +0000
   4 Subject: pstore: Fix NULL pointer dereference in console writes
   5
   6 From: Colin Ian King <colin.king@canonical.com>
   7
   8 commit 70a6f46d7b0ec03653b9ab3f8063a9717a4a53ef upstream.
   9
  10 Passing a NULL id causes a NULL pointer deference in writers such as
  11 erst_writer and efi_pstore_write because they expect to update this id.
  12 Pass a dummy id instead.
  13
  14 This avoids a cascade of oopses caused when the initial
  15 pstore_console_write passes a null which in turn causes writes to the
  16 console causing further oopses in subsequent pstore_console_write calls.
  17
  18 Signed-off-by: Colin Ian King <colin.king@canonical.com>
  19 Acked-by: Kees Cook <keescook@chromium.org>
  20 Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22
  23 ---
  24  fs/pstore/platform.c |    3 ++-
  25  1 file changed, 2 insertions(+), 1 deletion(-)
  26
  27 --- a/fs/pstore/platform.c
  28 +++ b/fs/pstore/platform.c
  29 @@ -161,12 +161,13 @@ static void pstore_console_write(struct
  30
  31         while (s < e) {
  32                 unsigned long flags;
  33 +               u64 id;
  34
  35                 if (c > psinfo->bufsize)
  36                         c = psinfo->bufsize;
  37                 spin_lock_irqsave(&psinfo->buf_lock, flags);
  38                 memcpy(psinfo->buf, s, c);
  39 -               psinfo->write(PSTORE_TYPE_CONSOLE, 0, NULL, 0, c, psinfo);
  40 +               psinfo->write(PSTORE_TYPE_CONSOLE, 0, &id, 0, c, psinfo);
  41                 spin_unlock_irqrestore(&psinfo->buf_lock, flags);
  42                 s += c;
  43                 c = e - s;