Re: [PATCH] printk: fix integer overflow in setup_log_buf()

[Petr Mladek]

On Wed 2018-10-10 20:33:08, Sergey Senozhatsky wrote:
> The way we calculate logbuf free space percentage overflows signed
> integer:
> 
> 	int free;
> 
> 	free = __LOG_BUF_LEN - log_next_idx;
> 	pr_info("early log buf free: %u(%u%%)\n",
> 		free, (free * 100) / __LOG_BUF_LEN);
> 
> We support LOG_BUF_LEN of up to 1<<25 bytes. Since setup_log_buf() is
> called during early init, logbuf is mostly empty, so
> 
> 	__LOG_BUF_LEN - log_next_idx
> 
> is close to 1<<25. Thus when we multiply it by 100, we overflow signed
> integer value range: 100 is 2^6 + 2^5 + 2^2.
> 
> Example, booting with LOG_BUF_LEN 1<<25 and log_buf_len=2G
> boot param:
> 
> [    0.075317] log_buf_len: -2147483648 bytes
> [    0.075319] early log buf free: 33549896(-28%)
> 
> Make "free" unsigned integer and use appropriate printk() specifier.
> 
> Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@xxxxxxxxx>

I have pushed this fix into printk.git, for-4.20 branch.

> --- a/kernel/printk/printk.c
> +++ b/kernel/printk/printk.c
> @@ -1116,8 +1116,8 @@ void __init setup_log_buf(int early)
>  	memcpy(log_buf, __log_buf, __LOG_BUF_LEN);
>  	logbuf_unlock_irqrestore(flags);
>  
> -	pr_info("log_buf_len: %d bytes\n", log_buf_len);
> -	pr_info("early log buf free: %d(%d%%)\n",
> +	pr_info("log_buf_len: %u bytes\n", log_buf_len);
> +	pr_info("early log buf free: %u(%u%%)\n",
>  		free, (free * 100) / __LOG_BUF_LEN);
>  }

Please note that this 2nd hunk was already part of the commit
e6fe3e5b7d16e8f14 ("printk: Give error on attempt to set log
buffer length to over 2G"), see
https://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk.git/commit/?h=for-4.20&id=e6fe3e5b7d16e8f146a4ae7fe481bc6e97acde1e

Best Regards,
Petr