lkml.org 
[lkml]   [2018]   [Oct]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] printk: fix integer overflow in setup_log_buf()
Date
The way we calculate free logbuf free space percentage
overflows signed integer:

int free;

free = __LOG_BUF_LEN - log_next_idx;
pr_info("early log buf free: %u(%u%%)\n",
free, (free * 100) / __LOG_BUF_LEN);

We support LOG_BUF_LEN of up to 2G, since setup_log_buf() is called
during early init logbuf is mostly empty, so

__LOG_BUF_LEN - log_next_idx

is close to 2G. When we multiply it by 100, we overflow signed
integer value range.

Example, booting with log_buf_len=2G boot param:

[ 0.075317] log_buf_len: -2147483648 bytes
[ 0.075319] early log buf free: 33549896(-28%)

Make "free" unsigned integer.

Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
---
kernel/printk/printk.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index c3f0e3927e77..c9e1d3bf695e 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1083,7 +1083,7 @@ void __init setup_log_buf(int early)
{
unsigned long flags;
char *new_log_buf;
- int free;
+ unsigned int free;

if (log_buf != __log_buf)
return;
@@ -1116,8 +1116,8 @@ void __init setup_log_buf(int early)
memcpy(log_buf, __log_buf, __LOG_BUF_LEN);
logbuf_unlock_irqrestore(flags);

- pr_info("log_buf_len: %d bytes\n", log_buf_len);
- pr_info("early log buf free: %d(%d%%)\n",
+ pr_info("log_buf_len: %u bytes\n", log_buf_len);
+ pr_info("early log buf free: %u(%u%%)\n",
free, (free * 100) / __LOG_BUF_LEN);
}

--
2.19.1
\
 
 \ /
  Last update: 2018-10-10 12:38    [W:0.185 / U:0.128 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site