[PATCH] printk_ringbuffer: Fix space_used() when blk_lpos->next overflows

[PATCH] printk_ringbuffer: Fix space_used() when blk_lpos->next overflows

[Wang Wensheng]

Since commit 67e1b0052f6b ("printk_ringbuffer: don't needlessly wrap data
blocks around") blk_lpos is treated as not wrapped when blk_lpos->next
overflows to the start of data_ring. We use the indices of blk_lpos->next
and blk_lpos->start to calculate the size of the data_block. This computes
zero minus a small positive value, resulting in underflow and an
unexpectedly large value. Simply using the original lpos with wrap-counts
solves the problem.

Fixes: 67e1b0052f6b ("printk_ringbuffer: don't needlessly wrap data blocks around")
Signed-off-by: Wang Wensheng <wsw9603@163.com>
---
 kernel/printk/printk_ringbuffer.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c
index d38e7c2f6887..46a79ec0940a 100644
--- a/kernel/printk/printk_ringbuffer.c
+++ b/kernel/printk/printk_ringbuffer.c
@@ -1237,11 +1237,9 @@ static unsigned int space_used(struct prb_data_ring *data_ring,
 	if (BLK_DATALESS(blk_lpos))
 		return 0;
 
-	if (!is_blk_wrapped(data_ring, blk_lpos->begin, blk_lpos->next)) {
-		/* Data block does not wrap. */
-		return (DATA_INDEX(data_ring, blk_lpos->next) -
-			DATA_INDEX(data_ring, blk_lpos->begin));
-	}
+	/* Data block does not wrap. */
+	if (!is_blk_wrapped(data_ring, blk_lpos->begin, blk_lpos->next))
+		return blk_lpos->next - blk_lpos->begin;
 
 	/*
 	 * For wrapping data blocks, the trailing (wasted) space is
-- 
2.43.0

Re: [PATCH] printk_ringbuffer: Fix space_used() when blk_lpos->next overflows

[John Ogness]

On 2026-10-04, Wang Wensheng <wsw9603@163.com> wrote:
> Since commit 67e1b0052f6b ("printk_ringbuffer: don't needlessly wrap data
> blocks around") blk_lpos is treated as not wrapped when blk_lpos->next
> overflows to the start of data_ring. We use the indices of blk_lpos->next
> and blk_lpos->start to calculate the size of the data_block. This computes
> zero minus a small positive value, resulting in underflow and an
> unexpectedly large value. Simply using the original lpos with wrap-counts
> solves the problem.
>
> Fixes: 67e1b0052f6b ("printk_ringbuffer: don't needlessly wrap data blocks around")
> Signed-off-by: Wang Wensheng <wsw9603@163.com>

Reviewed-by: John Ogness <john.ogness@linutronix.de>

Yes, this is a real bug and this is the correct fix. Thank you.

Fortunately the bug does not cause any problems for the kernel because
setup_log_buf() does not actually care if the "free space" has run
out. And if the ringbuffer has filled, then the free space is 0 anyway,
so even the reported "early log buf free" is correct.

For that reason, I do not think it is strictly necessary to backport
this to stable kernels. prb_record_text_space() is not exported.

But still, this is a bug and needs to be fixed.

The bug is easily visible using the kunit test by applying the following
trivial patch.

Before the fix I see max sizes of 4294959248. After the fix I see the
correct max sizes of 280.

diff --git a/kernel/printk/printk_ringbuffer_kunit_test.c b/kernel/printk/printk_ringbuffer_kunit_test.c
index 2282348e869a6..d100e6bd79120 100644
--- a/kernel/printk/printk_ringbuffer_kunit_test.c
+++ b/kernel/printk/printk_ringbuffer_kunit_test.c
@@ -113,6 +113,7 @@ static int prbtest_writer(void *data)
 	u32 record_size, text_size;
 	unsigned long count = 0;
 	struct printk_record r;
+	unsigned long max = 0;
 
 	kunit_info(tr->test_data->test, "start thread %03lu (writer)\n", tr->num);
 
@@ -154,6 +155,9 @@ static int prbtest_writer(void *data)
 			prb_commit(&e);
 
 			wake_up_interruptible(&tr->test_data->new_record_wait);
+
+			if (prb_record_text_space(&e) > max)
+				max = prb_record_text_space(&e);
 		}
 
 		if ((count++ & 0x3fff) == 0)
@@ -163,7 +167,7 @@ static int prbtest_writer(void *data)
 			break;
 	}
 
-	kunit_info(tr->test_data->test, "end thread %03lu: wrote=%lu\n", tr->num, count);
+	kunit_info(tr->test_data->test, "end thread %03lu: wrote=%lu max=%lu\n", tr->num, count, max);
 
 	return 0;
 }

John Ogness