Commit bb07b16c authored by John Ogness's avatar John Ogness Committed by Petr Mladek
Browse files

printk: limit second loop of syslog_print_all 



The second loop of syslog_print_all() subtracts lengths that were
added in the first loop. With commit b031a684 ("printk: remove
logbuf_lock writer-protection of ringbuffer") it is possible that
records are (over)written during syslog_print_all(). This allows the
possibility of the second loop subtracting lengths that were never
added in the first loop.

This situation can result in syslog_print_all() filling the buffer
starting from a later record, even though there may have been room
to fit the earlier record(s) as well.

Fixes: b031a684 ("printk: remove logbuf_lock writer-protection of ringbuffer")
Signed-off-by: default avatarJohn Ogness <john.ogness@linutronix.de>
Reviewed-by: default avatarPetr Mladek <pmladek@suse.com>
Signed-off-by: default avatarPetr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210303101528.29901-4-john.ogness@linutronix.de
parent 40ddbbac

kernel/printk/printk.c

+8 −1
Original line number Diff line number Diff line
@@ -1494,6 +1494,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear) 
	struct printk_info info;

	unsigned int line_count;

	struct printk_record r;

	u64 max_seq;

	char *text;

	int len = 0;

	u64 seq;
@@ -1512,9 +1513,15 @@ static int syslog_print_all(char __user *buf, int size, bool clear) 
	prb_for_each_info(clear_seq, prb, seq, &info, &line_count)

		len += get_record_print_text_size(&info, line_count, true, time);



	/*

	 * Set an upper bound for the next loop to avoid subtracting lengths

	 * that were never added.

	 */

	max_seq = seq;



	/* move first record forward until length fits into the buffer */

	prb_for_each_info(clear_seq, prb, seq, &info, &line_count) {

		if (len <= size)

		if (len <= size || info.seq >= max_seq)

			break;

		len -= get_record_print_text_size(&info, line_count, true, time);

	}