Skip to content

Commit 007ad27

Browse files
committed
Merge tag 'printk-for-5.11-urgent-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk fix from Petr Mladek: "The fix of a potential buffer overflow in 5.11-rc5 introduced another one. The trailing '\0' might be written up to the message "len" past the buffer. Fortunately, it is not that easy to hit. Most readers use 1kB buffers for a single message. Typical messages fit into the temporary buffer with enough reserve. Also readers do not rely on the '\0'. It is related to the previous fix. Some readers required the space for the trailing '\0'. We decided to write it there to avoid such regressions in the future. The most realistic victims are dumpers using kmsg_dump_get_buffer(). They are filling the entire buffer with as many messages as possible. They are typically used when handling panic()" * tag 'printk-for-5.11-urgent-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: fix string termination for record_print_text()
2 parents 6ee1d74 + 61bb17d commit 007ad27

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

kernel/printk/printk.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1398,7 +1398,7 @@ static size_t record_print_text(struct printk_record *r, bool syslog,
13981398
* not counted in the return value.
13991399
*/
14001400
if (buf_size > 0)
1401-
text[len] = 0;
1401+
r->text_buf[len] = 0;
14021402

14031403
return len;
14041404
}

0 commit comments

Comments
 (0)