From: Rabin Vincent <rab...@axis.com>

kmsg_dump_get_buffer() selects the youngest log messages which fit into
the provided buffer.  When that function determines the correct start
index, by looping and calling msg_print_text() with a NULL buffer, it
allows the youngest log messages to completely fill the provided buffer.

However, when doing the actual printing, an off-by-one error in
msg_print_text() leads to that function allowing the provided buffer to
only be filled to (size - 1).

So if the lengths of the selected youngest log messages happen to
completely fill up the provided buffer, the last log message is lost.

Note that msg_print_text() is also used from the syslog code but this
bug does trigger there since the buffers used in the syslog code are
never filled up completely (since they are only used to print individual
lines, and their size is always LOG_LINE_MAX + PREFIX_MAX, and
PREFIX_MAX is larger than the largest possible prefix).

Signed-off-by: Rabin Vincent <rab...@axis.com>
---
 kernel/printk/printk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index de08fc9..abac373 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1260,7 +1260,7 @@ static size_t msg_print_text(const struct printk_log 
*msg, enum log_flags prev,
 
                if (buf) {
                        if (print_prefix(msg, syslog, NULL) +
-                           text_len + 1 >= size - len)
+                           text_len + 1 > size - len)
                                break;
 
                        if (prefix)
-- 
2.7.0

Reply via email to