printk: return -EINVAL if the message len is bigger than the buf size
authorYuanhan Liu <yuanhan.liu@linux.intel.com>
Sat, 16 Jun 2012 04:40:55 +0000 (12:40 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 16 Jun 2012 15:36:03 +0000 (08:36 -0700)
Just like what devkmsg_read() does, return -EINVAL if the message len is
bigger than the buf size, or it will trigger a segfault error.

Acked-by: Kay Sievers <kay@vrfy.org>
Acked-by: Fengguang Wu <wfg@linux.intel.com>
Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/printk.c

index 572730bd8a5ccb6ed33372bcedd3fab9fd024584..a2276b9167691f164c0753d1c3f0d6ff0b7090e9 100644 (file)
@@ -880,7 +880,9 @@ static int syslog_print(char __user *buf, int size)
        syslog_seq++;
        raw_spin_unlock_irq(&logbuf_lock);
 
-       if (len > 0 && copy_to_user(buf, text, len))
+       if (len > size)
+               len = -EINVAL;
+       else if (len > 0 && copy_to_user(buf, text, len))
                len = -EFAULT;
 
        kfree(text);