printk: fix integer overflow in setup_log_buf()

sergey-senozhatsky · pmladek · commit d2130e82e945 · 2018-10-12T10:44:17.000+02:00
The way we calculate logbuf free space percentage overflows signed integer: int free; free = __LOG_BUF_LEN - log_next_idx; pr_info("early log buf free: %u(%u%%)\n", free, (free * 100) / __LOG_BUF_LEN); We support LOG_BUF_LEN of up to 1<<25 bytes. Since setup_log_buf() is called during early init, logbuf is mostly empty, so __LOG_BUF_LEN - log_next_idx is close to 1<<25. Thus when we multiply it by 100, we overflow signed integer value range: 100 is 2^6 + 2^5 + 2^2. Example, booting with LOG_BUF_LEN 1<<25 and log_buf_len=2G boot param: [ 0.075317] log_buf_len: -2147483648 bytes [ 0.075319] early log buf free: 33549896(-28%) Make "free" unsigned integer and use appropriate printk() specifier. Link: http://lkml.kernel.org/r/20181010113308.9337-1-sergey.senozhatsky@gmail.com To: Steven Rostedt <rostedt@goodmis.org> Cc: linux-kernel@vger.kernel.org Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com> Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> Signed-off-by: Petr Mladek <pmladek@suse.com>
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
@@ -1098,7 +1098,7 @@ void __init setup_log_buf(int early)
 {
 	unsigned long flags;
 	char *new_log_buf;
-	int free;
+	unsigned int free;
 
 	if (log_buf != __log_buf)
 		return;

Original file line number	Diff line number	Diff line change
`@@ -1098,7 +1098,7 @@ void __init setup_log_buf(int early)`
`1098`	`1098`	`{`
`1099`	`1099`	`unsigned long flags;`
`1100`	`1100`	`char *new_log_buf;`
`1101`		`- int free;`
	`1101`	`+ unsigned int free;`
`1102`	`1102`
`1103`	`1103`	`if (log_buf != __log_buf)`
`1104`	`1104`	`return;`