* [PATCH] printk: fix integer overflow in setup_log_buf()
@ 2018-10-10 10:38 Sergey Senozhatsky
2018-10-10 11:31 ` Sergey Senozhatsky
2018-10-10 11:33 ` Sergey Senozhatsky
0 siblings, 2 replies; 6+ messages in thread
From: Sergey Senozhatsky @ 2018-10-10 10:38 UTC (permalink / raw)
To: Steven Rostedt, Petr Mladek; +Cc: linux-kernel, Sergey Senozhatsky
The way we calculate free logbuf free space percentage
overflows signed integer:
int free;
free = __LOG_BUF_LEN - log_next_idx;
pr_info("early log buf free: %u(%u%%)\n",
free, (free * 100) / __LOG_BUF_LEN);
We support LOG_BUF_LEN of up to 2G, since setup_log_buf() is called
during early init logbuf is mostly empty, so
__LOG_BUF_LEN - log_next_idx
is close to 2G. When we multiply it by 100, we overflow signed
integer value range.
Example, booting with log_buf_len=2G boot param:
[ 0.075317] log_buf_len: -2147483648 bytes
[ 0.075319] early log buf free: 33549896(-28%)
Make "free" unsigned integer.
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
---
kernel/printk/printk.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index c3f0e3927e77..c9e1d3bf695e 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1083,7 +1083,7 @@ void __init setup_log_buf(int early)
{
unsigned long flags;
char *new_log_buf;
- int free;
+ unsigned int free;
if (log_buf != __log_buf)
return;
@@ -1116,8 +1116,8 @@ void __init setup_log_buf(int early)
memcpy(log_buf, __log_buf, __LOG_BUF_LEN);
logbuf_unlock_irqrestore(flags);
- pr_info("log_buf_len: %d bytes\n", log_buf_len);
- pr_info("early log buf free: %d(%d%%)\n",
+ pr_info("log_buf_len: %u bytes\n", log_buf_len);
+ pr_info("early log buf free: %u(%u%%)\n",
free, (free * 100) / __LOG_BUF_LEN);
}
--
2.19.1
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] printk: fix integer overflow in setup_log_buf()
2018-10-10 10:38 [PATCH] printk: fix integer overflow in setup_log_buf() Sergey Senozhatsky
@ 2018-10-10 11:31 ` Sergey Senozhatsky
2018-10-10 11:33 ` Sergey Senozhatsky
1 sibling, 0 replies; 6+ messages in thread
From: Sergey Senozhatsky @ 2018-10-10 11:31 UTC (permalink / raw)
To: Steven Rostedt, Petr Mladek
Cc: linux-kernel, Sergey Senozhatsky, Sergey Senozhatsky
On (10/10/18 19:38), Sergey Senozhatsky wrote:
> The way we calculate free logbuf free space percentage
> overflows signed integer:
>
> int free;
>
> free = __LOG_BUF_LEN - log_next_idx;
> pr_info("early log buf free: %u(%u%%)\n",
> free, (free * 100) / __LOG_BUF_LEN);
>
> We support LOG_BUF_LEN of up to 2G, since setup_log_buf() is called
> during early init logbuf is mostly empty, so
>
> __LOG_BUF_LEN - log_next_idx
>
> is close to 2G. When we multiply it by 100, we overflow signed
> integer value range.
I'm really sorry. The commit message got totally messed up here.
What I meant was 1<<25. I used 2G as a boot param for testing to
set up a proper new_log_buf_len value. And somehow got confused,
I was in a hurry. I'll send a follow up with fixed commit message.
-ss
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH] printk: fix integer overflow in setup_log_buf()
2018-10-10 10:38 [PATCH] printk: fix integer overflow in setup_log_buf() Sergey Senozhatsky
2018-10-10 11:31 ` Sergey Senozhatsky
@ 2018-10-10 11:33 ` Sergey Senozhatsky
2018-10-12 9:01 ` Petr Mladek
1 sibling, 1 reply; 6+ messages in thread
From: Sergey Senozhatsky @ 2018-10-10 11:33 UTC (permalink / raw)
To: Steven Rostedt, Petr Mladek
Cc: linux-kernel, Sergey Senozhatsky, Sergey Senozhatsky
The way we calculate logbuf free space percentage overflows signed
integer:
int free;
free = __LOG_BUF_LEN - log_next_idx;
pr_info("early log buf free: %u(%u%%)\n",
free, (free * 100) / __LOG_BUF_LEN);
We support LOG_BUF_LEN of up to 1<<25 bytes. Since setup_log_buf() is
called during early init, logbuf is mostly empty, so
__LOG_BUF_LEN - log_next_idx
is close to 1<<25. Thus when we multiply it by 100, we overflow signed
integer value range: 100 is 2^6 + 2^5 + 2^2.
Example, booting with LOG_BUF_LEN 1<<25 and log_buf_len=2G
boot param:
[ 0.075317] log_buf_len: -2147483648 bytes
[ 0.075319] early log buf free: 33549896(-28%)
Make "free" unsigned integer and use appropriate printk() specifier.
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
---
kernel/printk/printk.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index c3f0e3927e77..c9e1d3bf695e 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1083,7 +1083,7 @@ void __init setup_log_buf(int early)
{
unsigned long flags;
char *new_log_buf;
- int free;
+ unsigned int free;
if (log_buf != __log_buf)
return;
@@ -1116,8 +1116,8 @@ void __init setup_log_buf(int early)
memcpy(log_buf, __log_buf, __LOG_BUF_LEN);
logbuf_unlock_irqrestore(flags);
- pr_info("log_buf_len: %d bytes\n", log_buf_len);
- pr_info("early log buf free: %d(%d%%)\n",
+ pr_info("log_buf_len: %u bytes\n", log_buf_len);
+ pr_info("early log buf free: %u(%u%%)\n",
free, (free * 100) / __LOG_BUF_LEN);
}
--
2.19.1
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] printk: fix integer overflow in setup_log_buf()
2018-10-10 11:33 ` Sergey Senozhatsky
@ 2018-10-12 9:01 ` Petr Mladek
2018-10-12 9:27 ` Sergey Senozhatsky
0 siblings, 1 reply; 6+ messages in thread
From: Petr Mladek @ 2018-10-12 9:01 UTC (permalink / raw)
To: Sergey Senozhatsky; +Cc: Steven Rostedt, linux-kernel, Sergey Senozhatsky
On Wed 2018-10-10 20:33:08, Sergey Senozhatsky wrote:
> The way we calculate logbuf free space percentage overflows signed
> integer:
>
> int free;
>
> free = __LOG_BUF_LEN - log_next_idx;
> pr_info("early log buf free: %u(%u%%)\n",
> free, (free * 100) / __LOG_BUF_LEN);
>
> We support LOG_BUF_LEN of up to 1<<25 bytes. Since setup_log_buf() is
> called during early init, logbuf is mostly empty, so
>
> __LOG_BUF_LEN - log_next_idx
>
> is close to 1<<25. Thus when we multiply it by 100, we overflow signed
> integer value range: 100 is 2^6 + 2^5 + 2^2.
>
> Example, booting with LOG_BUF_LEN 1<<25 and log_buf_len=2G
> boot param:
>
> [ 0.075317] log_buf_len: -2147483648 bytes
> [ 0.075319] early log buf free: 33549896(-28%)
>
> Make "free" unsigned integer and use appropriate printk() specifier.
>
> Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
I have pushed this fix into printk.git, for-4.20 branch.
> --- a/kernel/printk/printk.c
> +++ b/kernel/printk/printk.c
> @@ -1116,8 +1116,8 @@ void __init setup_log_buf(int early)
> memcpy(log_buf, __log_buf, __LOG_BUF_LEN);
> logbuf_unlock_irqrestore(flags);
>
> - pr_info("log_buf_len: %d bytes\n", log_buf_len);
> - pr_info("early log buf free: %d(%d%%)\n",
> + pr_info("log_buf_len: %u bytes\n", log_buf_len);
> + pr_info("early log buf free: %u(%u%%)\n",
> free, (free * 100) / __LOG_BUF_LEN);
> }
Please note that this 2nd hunk was already part of the commit
e6fe3e5b7d16e8f14 ("printk: Give error on attempt to set log
buffer length to over 2G"), see
https://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk.git/commit/?h=for-4.20&id=e6fe3e5b7d16e8f146a4ae7fe481bc6e97acde1e
Best Regards,
Petr
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] printk: fix integer overflow in setup_log_buf()
2018-10-12 9:01 ` Petr Mladek
@ 2018-10-12 9:27 ` Sergey Senozhatsky
2018-10-12 10:33 ` Petr Mladek
0 siblings, 1 reply; 6+ messages in thread
From: Sergey Senozhatsky @ 2018-10-12 9:27 UTC (permalink / raw)
To: Petr Mladek
Cc: Sergey Senozhatsky, Steven Rostedt, linux-kernel, Sergey Senozhatsky
On (10/12/18 11:01), Petr Mladek wrote:
> > Make "free" unsigned integer and use appropriate printk() specifier.
> >
> > Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
>
> I have pushed this fix into printk.git, for-4.20 branch.
Thanks.
> Please note that this 2nd hunk was already part of the commit
> e6fe3e5b7d16e8f14 ("printk: Give error on attempt to set log
> buffer length to over 2G"), see
> https://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk.git/commit/?h=for-4.20&id=e6fe3e5b7d16e8f146a4ae7fe481bc6e97acde1e
Oh, indeed. I guess I used linux-next which didn't have your commit.
-ss
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] printk: fix integer overflow in setup_log_buf()
2018-10-12 9:27 ` Sergey Senozhatsky
@ 2018-10-12 10:33 ` Petr Mladek
0 siblings, 0 replies; 6+ messages in thread
From: Petr Mladek @ 2018-10-12 10:33 UTC (permalink / raw)
To: Sergey Senozhatsky; +Cc: Sergey Senozhatsky, Steven Rostedt, linux-kernel
On Fri 2018-10-12 18:27:24, Sergey Senozhatsky wrote:
> On (10/12/18 11:01), Petr Mladek wrote:
> > > Make "free" unsigned integer and use appropriate printk() specifier.
> > >
> > > Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> >
> > I have pushed this fix into printk.git, for-4.20 branch.
>
> Thanks.
>
> > Please note that this 2nd hunk was already part of the commit
> > e6fe3e5b7d16e8f14 ("printk: Give error on attempt to set log
> > buffer length to over 2G"), see
> > https://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk.git/commit/?h=for-4.20&id=e6fe3e5b7d16e8f146a4ae7fe481bc6e97acde1e
>
> Oh, indeed. I guess I used linux-next which didn't have your commit.
Yeah, I forgot to push some recent changes for linux-next.
Best Regards,
Petr
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2018-10-12 10:33 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-10-10 10:38 [PATCH] printk: fix integer overflow in setup_log_buf() Sergey Senozhatsky
2018-10-10 11:31 ` Sergey Senozhatsky
2018-10-10 11:33 ` Sergey Senozhatsky
2018-10-12 9:01 ` Petr Mladek
2018-10-12 9:27 ` Sergey Senozhatsky
2018-10-12 10:33 ` Petr Mladek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®