git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From Alexandre.Simon@univ-lorraine.fr  Mon Feb 18 09:52:16 2013
   2 From: Alexandre SIMON <Alexandre.Simon@univ-lorraine.fr>
   3 Date: Fri, 01 Feb 2013 15:31:54 +0100
   4 Subject: printk: fix buffer overflow when calling log_prefix function from call_console_drivers
   5 To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org
   6 Cc: "Serge E. Hallyn" <serge@hallyn.com>, Jonathan Nieder <jrnieder@gmail.com>, James Morris <jmorris@namei.org>
   7 Message-ID: <510BD1DA.4010709@univ-lorraine.fr>
   8
   9 From: Alexandre SIMON <Alexandre.Simon@univ-lorraine.fr>
  10
  11 This patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling
  12 log_prefix() function from call_console_drivers().
  13
  14 This bug existed in previous releases but has been revealed with commit
  15 162a7e7500f9664636e649ba59defe541b7c2c60 (2.6.39 => 3.0) that made changes
  16 about how to allocate memory for early printk buffer (use of memblock_alloc).
  17 It disappears with commit 7ff9554bb578ba02166071d2d487b7fc7d860d62 (3.4 => 3.5)
  18 that does a refactoring of printk buffer management.
  19
  20 In log_prefix(), the access to "p[0]", "p[1]", "p[2]" or
  21 "simple_strtoul(&p[1], &endp, 10)" may cause a buffer overflow as this
  22 function is called from call_console_drivers by passing "&LOG_BUF(cur_index)"
  23 where the index must be masked to do not exceed the buffer's boundary.
  24
  25 The trick is to prepare in call_console_drivers() a buffer with the necessary
  26 data (PRI field of syslog message) to be safely evaluated in log_prefix().
  27
  28 This patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.
  29
  30 Without this patch, one can freeze a server running this loop from shell :
  31   $ export DUMMY=`cat /dev/urandom | tr -dc '12345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn' | head -c255`
  32   $ while true do ; echo $DUMMY > /dev/kmsg ; done
  33
  34 The "server freeze" depends on where memblock_alloc does allocate printk buffer :
  35 if the buffer overflow is inside another kernel allocation the problem may not
  36 be revealed, else the server may hangs up.
  37
  38 Signed-off-by: Alexandre SIMON <Alexandre.Simon@univ-lorraine.fr>
  39 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  40
  41 ---
  42  include/linux/syslog.h |    6 ++++++
  43  kernel/printk.c        |   13 ++++++++++++-
  44  2 files changed, 18 insertions(+), 1 deletion(-)
  45
  46 --- a/include/linux/syslog.h
  47 +++ b/include/linux/syslog.h
  48 @@ -47,6 +47,12 @@
  49  #define SYSLOG_FROM_CALL 0
  50  #define SYSLOG_FROM_FILE 1
  51
  52 +/*
  53 + * Syslog priority (PRI) maximum length in char : '<[0-9]{1,3}>'
  54 + * See RFC5424 for details
  55 +*/
  56 +#define SYSLOG_PRI_MAX_LENGTH 5
  57 +
  58  int do_syslog(int type, char __user *buf, int count, bool from_file);
  59
  60  #endif /* _LINUX_SYSLOG_H */
  61 --- a/kernel/printk.c
  62 +++ b/kernel/printk.c
  63 @@ -633,8 +633,19 @@ static void call_console_drivers(unsigne
  64         start_print = start;
  65         while (cur_index != end) {
  66                 if (msg_level < 0 && ((end - cur_index) > 2)) {
  67 +                       /*
  68 +                        * prepare buf_prefix, as a contiguous array,
  69 +                        * to be processed by log_prefix function
  70 +                        */
  71 +                       char buf_prefix[SYSLOG_PRI_MAX_LENGTH+1];
  72 +                       unsigned i;
  73 +                       for (i = 0; i < ((end - cur_index)) && (i < SYSLOG_PRI_MAX_LENGTH); i++) {
  74 +                               buf_prefix[i] = LOG_BUF(cur_index + i);
  75 +                       }
  76 +                       buf_prefix[i] = '\0'; /* force '\0' as last string character */
  77 +
  78                         /* strip log prefix */
  79 -                       cur_index += log_prefix(&LOG_BUF(cur_index), &msg_level, NULL);
  80 +                       cur_index += log_prefix((const char *)&buf_prefix, &msg_level, NULL);
  81                         start_print = cur_index;
  82                 }
  83                 while (cur_index != end) {