diff options
author | Tejun Heo <htejun@gmail.com> | 2008-02-13 20:32:07 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2008-02-26 10:42:37 -0500 |
commit | cf3680b90c7842cf91ed857ac4528f4e057da366 (patch) | |
tree | f73af36b208fab34620808f0075cc54f51cfdfb0 | |
parent | bfa274e2436fc7ef72ef51c878083647f1cfd429 (diff) |
printk: fix possible printk overrun
printk recursion detection prepends message to printk_buf and offsets
printk_buf when actual message is printed but it forgets to trim buffer
length accordingly. This can result in overrun in extreme cases. Fix it.
[ mingo@elte.hu:
bug was introduced by me via:
commit 32a76006683f7b28ae3cc491da37716e002f198e
Author: Ingo Molnar <mingo@elte.hu>
Date: Fri Jan 25 21:07:58 2008 +0100
printk: make printk more robust by not allowing recursion
]
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r-- | kernel/printk.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/printk.c b/kernel/printk.c index bee36100f110..9adc2a473e6e 100644 --- a/kernel/printk.c +++ b/kernel/printk.c | |||
@@ -666,7 +666,7 @@ asmlinkage int vprintk(const char *fmt, va_list args) | |||
666 | } | 666 | } |
667 | /* Emit the output into the temporary buffer */ | 667 | /* Emit the output into the temporary buffer */ |
668 | printed_len += vscnprintf(printk_buf + printed_len, | 668 | printed_len += vscnprintf(printk_buf + printed_len, |
669 | sizeof(printk_buf), fmt, args); | 669 | sizeof(printk_buf) - printed_len, fmt, args); |
670 | 670 | ||
671 | /* | 671 | /* |
672 | * Copy the output into log_buf. If the caller didn't provide | 672 | * Copy the output into log_buf. If the caller didn't provide |