diff options
author | Sergey Senozhatsky <sergey.senozhatsky@gmail.com> | 2018-10-10 20:33:08 +0900 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-12-01 09:16:14 +0100 |
commit | 4465a916eaa733c0dd369a108a4c0c349bfcc013 (patch) | |
tree | f3d2d50421b7c8a3045e792887280d4993d49d5f | |
parent | 90d73768ddb6eac2df86c60072fbfe4d87e1d051 (diff) | |
download | linux-stable-4465a916eaa733c0dd369a108a4c0c349bfcc013.tar.gz linux-stable-4465a916eaa733c0dd369a108a4c0c349bfcc013.tar.bz2 linux-stable-4465a916eaa733c0dd369a108a4c0c349bfcc013.zip |
printk: fix integer overflow in setup_log_buf()
[ Upstream commit d2130e82e9454304e9b91ba9da551b5989af8c27 ]
The way we calculate logbuf free space percentage overflows signed
integer:
int free;
free = __LOG_BUF_LEN - log_next_idx;
pr_info("early log buf free: %u(%u%%)\n",
free, (free * 100) / __LOG_BUF_LEN);
We support LOG_BUF_LEN of up to 1<<25 bytes. Since setup_log_buf() is
called during early init, logbuf is mostly empty, so
__LOG_BUF_LEN - log_next_idx
is close to 1<<25. Thus when we multiply it by 100, we overflow signed
integer value range: 100 is 2^6 + 2^5 + 2^2.
Example, booting with LOG_BUF_LEN 1<<25 and log_buf_len=2G
boot param:
[ 0.075317] log_buf_len: -2147483648 bytes
[ 0.075319] early log buf free: 33549896(-28%)
Make "free" unsigned integer and use appropriate printk() specifier.
Link: http://lkml.kernel.org/r/20181010113308.9337-1-sergey.senozhatsky@gmail.com
To: Steven Rostedt <rostedt@goodmis.org>
Cc: linux-kernel@vger.kernel.org
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
-rw-r--r-- | kernel/printk/printk.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index 59ceaed1aeed..845efadaf7ec 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -1105,7 +1105,7 @@ void __init setup_log_buf(int early) { unsigned long flags; char *new_log_buf; - int free; + unsigned int free; if (log_buf != __log_buf) return; |