Re: [PATCH] printk: Fix incorrect length from print_time() when seconds > 99999

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Fri, Dec 28, 2012 at 08:23:04PM -0800, Roland Dreier wrote:
> From: Roland Dreier <roland@purestorage.com>
> 
> print_prefix() passes a NULL buf to print_time() to get the length of
> the time prefix; when printk times are enabled, the current code just
> returns the constant 15, which matches the format "[%5lu.%06lu] " used
> to print the time value.  However, this is obviously incorrect when
> the whole seconds part of the time gets beyond 5 digits (100000
> seconds is a bit more than a day of uptime).
> 
> The simple fix is to use snprintf(NULL, 0, ...) to calculate the
> actual length of the time prefix.  This could be micro-optimized but
> it seems better to have simpler, more readable code here.
> 
> The bug leads to the syslog system call miscomputing which messages
> fit into the userspace buffer.  If there are enough messages to fill
> log_buf_len and some have a timestamp >= 100000, dmesg may fail with:
> 
>     # dmesg
>     klogctl: Bad address
> 
> When this happens, strace shows that the failure is indeed EFAULT due
> to the kernel mistakenly accessing past the end of dmesg's buffer,
> since dmesg asks the kernel how big a buffer it needs, allocates a bit
> more, and then gets an error when it asks the kernel to fill it:
> 
>     syslog(0xa, 0, 0)                       = 1048576
>     mmap(NULL, 1052672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa4d25d2000
>     syslog(0x3, 0x7fa4d25d2010, 0x100008)   = -1 EFAULT (Bad address)
> 
> Signed-off-by: Roland Dreier <roland@purestorage.com>

Nice work.  When did you start seeing this problem, 3.6 or so?  I ask as
it's probably something that should go to stable as well if so.

Andrew seems to be keeping the printk patches these days, so I'll let
him pick this up with:

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>