)]}'
{
  "commit": "ce0030c00f95cf9110d9cdcd41e901e1fb814417",
  "tree": "40b124b99205bd469ed156b682d7f0f4e5726e5a",
  "parents": [
    "9ad3bfb9e26197c378d6c239180ed7bcf7c29fd8"
  ],
  "author": {
    "name": "Alexandre SIMON",
    "email": "Alexandre.Simon@univ-lorraine.fr",
    "time": "Fri Feb 01 15:31:54 2013 +0100"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Thu Feb 21 10:04:57 2013 -0800"
  },
  "message": "printk: fix buffer overflow when calling log_prefix function from call_console_drivers\n\nThis patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling\nlog_prefix() function from call_console_drivers().\n\nThis bug existed in previous releases but has been revealed with commit\n162a7e7500f9664636e649ba59defe541b7c2c60 (2.6.39 \u003d\u003e 3.0) that made changes\nabout how to allocate memory for early printk buffer (use of memblock_alloc).\nIt disappears with commit 7ff9554bb578ba02166071d2d487b7fc7d860d62 (3.4 \u003d\u003e 3.5)\nthat does a refactoring of printk buffer management.\n\nIn log_prefix(), the access to \"p[0]\", \"p[1]\", \"p[2]\" or\n\"simple_strtoul(\u0026p[1], \u0026endp, 10)\" may cause a buffer overflow as this\nfunction is called from call_console_drivers by passing \"\u0026LOG_BUF(cur_index)\"\nwhere the index must be masked to do not exceed the buffer\u0027s boundary.\n\nThe trick is to prepare in call_console_drivers() a buffer with the necessary\ndata (PRI field of syslog message) to be safely evaluated in log_prefix().\n\nThis patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.\n\nWithout this patch, one can freeze a server running this loop from shell :\n  $ export DUMMY\u003d`cat /dev/urandom | tr -dc \u002712345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn\u0027 | head -c255`\n  $ while true do ; echo $DUMMY \u003e /dev/kmsg ; done\n\nThe \"server freeze\" depends on where memblock_alloc does allocate printk buffer :\nif the buffer overflow is inside another kernel allocation the problem may not\nbe revealed, else the server may hangs up.\n\nSigned-off-by: Alexandre SIMON \u003cAlexandre.Simon@univ-lorraine.fr\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "38911391a139a37376e2053008d6e7bb49559cd5",
      "old_mode": 33188,
      "old_path": "include/linux/syslog.h",
      "new_id": "ce4c6655605937c62d7048d6ee0b7130d47d703c",
      "new_mode": 33188,
      "new_path": "include/linux/syslog.h"
    },
    {
      "type": "modify",
      "old_id": "b663c2c95d3922e4c080e8974c09c6ce99b4355f",
      "old_mode": 33188,
      "old_path": "kernel/printk.c",
      "new_id": "e95c66223d33f864f6408d85b8cef4881f2f1df8",
      "new_mode": 33188,
      "new_path": "kernel/printk.c"
    }
  ]
}