Re: [PATCH] printk_ringbuffer: Fix space_used() when blk_lpos->next overflows

[John Ogness]

On 2026-10-04, Wang Wensheng <wsw9603@xxxxxxx> wrote:
> Since commit 67e1b0052f6b ("printk_ringbuffer: don't needlessly wrap data
> blocks around") blk_lpos is treated as not wrapped when blk_lpos->next
> overflows to the start of data_ring. We use the indices of blk_lpos->next
> and blk_lpos->start to calculate the size of the data_block. This computes
> zero minus a small positive value, resulting in underflow and an
> unexpectedly large value. Simply using the original lpos with wrap-counts
> solves the problem.
>
> Fixes: 67e1b0052f6b ("printk_ringbuffer: don't needlessly wrap data blocks around")
> Signed-off-by: Wang Wensheng <wsw9603@xxxxxxx>

Reviewed-by: John Ogness <john.ogness@xxxxxxxxxxxxx>

Yes, this is a real bug and this is the correct fix. Thank you.

Fortunately the bug does not cause any problems for the kernel because
setup_log_buf() does not actually care if the "free space" has run
out. And if the ringbuffer has filled, then the free space is 0 anyway,
so even the reported "early log buf free" is correct.

For that reason, I do not think it is strictly necessary to backport
this to stable kernels. prb_record_text_space() is not exported.

But still, this is a bug and needs to be fixed.

The bug is easily visible using the kunit test by applying the following
trivial patch.

Before the fix I see max sizes of 4294959248. After the fix I see the
correct max sizes of 280.

diff --git a/kernel/printk/printk_ringbuffer_kunit_test.c b/kernel/printk/printk_ringbuffer_kunit_test.c
index 2282348e869a6..d100e6bd79120 100644
--- a/kernel/printk/printk_ringbuffer_kunit_test.c
+++ b/kernel/printk/printk_ringbuffer_kunit_test.c
@@ -113,6 +113,7 @@ static int prbtest_writer(void *data)
 	u32 record_size, text_size;
 	unsigned long count = 0;
 	struct printk_record r;
+	unsigned long max = 0;
 
 	kunit_info(tr->test_data->test, "start thread %03lu (writer)\n", tr->num);
 
@@ -154,6 +155,9 @@ static int prbtest_writer(void *data)
 			prb_commit(&e);
 
 			wake_up_interruptible(&tr->test_data->new_record_wait);
+
+			if (prb_record_text_space(&e) > max)
+				max = prb_record_text_space(&e);
 		}
 
 		if ((count++ & 0x3fff) == 0)
@@ -163,7 +167,7 @@ static int prbtest_writer(void *data)
 			break;
 	}
 
-	kunit_info(tr->test_data->test, "end thread %03lu: wrote=%lu\n", tr->num, count);
+	kunit_info(tr->test_data->test, "end thread %03lu: wrote=%lu max=%lu\n", tr->num, count, max);
 
 	return 0;
 }

John Ogness