Messages in this thread | | | Date | Fri, 12 Oct 2018 11:01:59 +0200 | From | Petr Mladek <> | Subject | Re: [PATCH] printk: fix integer overflow in setup_log_buf() |
| |
On Wed 2018-10-10 20:33:08, Sergey Senozhatsky wrote: > The way we calculate logbuf free space percentage overflows signed > integer: > > int free; > > free = __LOG_BUF_LEN - log_next_idx; > pr_info("early log buf free: %u(%u%%)\n", > free, (free * 100) / __LOG_BUF_LEN); > > We support LOG_BUF_LEN of up to 1<<25 bytes. Since setup_log_buf() is > called during early init, logbuf is mostly empty, so > > __LOG_BUF_LEN - log_next_idx > > is close to 1<<25. Thus when we multiply it by 100, we overflow signed > integer value range: 100 is 2^6 + 2^5 + 2^2. > > Example, booting with LOG_BUF_LEN 1<<25 and log_buf_len=2G > boot param: > > [ 0.075317] log_buf_len: -2147483648 bytes > [ 0.075319] early log buf free: 33549896(-28%) > > Make "free" unsigned integer and use appropriate printk() specifier. > > Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
I have pushed this fix into printk.git, for-4.20 branch.
> --- a/kernel/printk/printk.c > +++ b/kernel/printk/printk.c > @@ -1116,8 +1116,8 @@ void __init setup_log_buf(int early) > memcpy(log_buf, __log_buf, __LOG_BUF_LEN); > logbuf_unlock_irqrestore(flags); > > - pr_info("log_buf_len: %d bytes\n", log_buf_len); > - pr_info("early log buf free: %d(%d%%)\n", > + pr_info("log_buf_len: %u bytes\n", log_buf_len); > + pr_info("early log buf free: %u(%u%%)\n", > free, (free * 100) / __LOG_BUF_LEN); > }
Please note that this 2nd hunk was already part of the commit e6fe3e5b7d16e8f14 ("printk: Give error on attempt to set log buffer length to over 2G"), see https://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk.git/commit/?h=for-4.20&id=e6fe3e5b7d16e8f146a4ae7fe481bc6e97acde1e
Best Regards, Petr
| |