linux-kernel - [PATCH RT] printk: handle iterating while buffer changing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 7 Oct 2019 17:14:50 +0200
From:   Sebastian Andrzej Siewior <bigeasy@...utronix.de>
To:     LKML <linux-kernel@...r.kernel.org>
Cc:     linux-rt-users <linux-rt-users@...r.kernel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        John Ogness <john.ogness@...utronix.de>
Subject: [PATCH RT] printk: handle iterating while buffer changing

From: John Ogness <john.ogness@...utronix.de>

The syslog and kmsg_dump readers are provided buffers to fill.
Both try to maximize the provided buffer usage by calculating the
maximum number of messages that can fit. However, if after the
calculation, messages are dropped and new messages added, the
calculation will no longer match.

For syslog, add a check to make sure the provided buffer is not
overfilled.

For kmsg_dump, start over by recalculating the messages
available.

Signed-off-by: John Ogness <john.ogness@...utronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
---

This reassembles the behaviour that commit
   c9dccacfccc72 ("printk: Do not lose last line in kmsg buffer dump")

did for the "old" printk code.

 kernel/printk/printk.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 58c545a528b3b..9d9523431178b 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1436,6 +1436,9 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
 			break;
 		}
 
+		if (len + textlen > size)
+			break;
+
 		if (copy_to_user(buf + len, text, textlen))
 			len = -EFAULT;
 		else
@@ -3075,7 +3078,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
 		ret = prb_iter_next(&iter, msgbuf, PRINTK_RECORD_MAX, &seq);
 		if (ret == 0) {
 			break;
-		} else if (ret < 0) {
+		} else if (ret < 0 || seq >= end_seq) {
 			prb_iter_init(&iter, &printk_rb, &seq);
 			goto retry;
 		}
-- 
2.23.0