Below the uiomove() conversion for kern/subr_log.c. msg_buf[rsx] are all
of type long, but are always positive. This diff prevents truncation of
uio_resid (and l) due to min() usage.

Index: kern/subr_log.c
===================================================================
RCS file: /cvs/src/sys/kern/subr_log.c,v
retrieving revision 1.36
diff -u -p -u -r1.36 subr_log.c
--- kern/subr_log.c     7 Jan 2016 12:27:07 -0000       1.36
+++ kern/subr_log.c     9 Jan 2016 14:49:27 -0000
@@ -180,7 +180,7 @@ int
 logread(dev_t dev, struct uio *uio, int flag)
 {
        struct msgbuf *mbp = msgbufp;
-       long l;
+       size_t l;
        int s;
        int error = 0;
 
@@ -202,13 +202,14 @@ logread(dev_t dev, struct uio *uio, int 
        logsoftc.sc_state &= ~LOG_RDWAIT;
 
        while (uio->uio_resid > 0) {
-               l = mbp->msg_bufx - mbp->msg_bufr;
-               if (l < 0)
+               if (mbp->msg_bufx >= mbp->msg_bufr)
+                       l = mbp->msg_bufx - mbp->msg_bufr;
+               else
                        l = mbp->msg_bufs - mbp->msg_bufr;
-               l = min(l, uio->uio_resid);
+               l = ulmin(l, uio->uio_resid);
                if (l == 0)
                        break;
-               error = uiomovei(&mbp->msg_bufc[mbp->msg_bufr], (int)l, uio);
+               error = uiomove(&mbp->msg_bufc[mbp->msg_bufr], l, uio);
                if (error)
                        break;
                mbp->msg_bufr += l;

cheers,
natano

Reply via email to