From: Yuanhan Liu <yuanhan.liu@linux.intel.com>
Date: Sat, 16 Jun 2012 04:40:55 +0000 (+0800)
Subject: printk: return -EINVAL if the message len is bigger than the buf size
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b56a39ac263e5b8cafedd551a49c2105e68b98c2;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git

printk: return -EINVAL if the message len is bigger than the buf size

Just like what devkmsg_read() does, return -EINVAL if the message len is
bigger than the buf size, or it will trigger a segfault error.

Acked-by: Kay Sievers <kay@vrfy.org>
Acked-by: Fengguang Wu <wfg@linux.intel.com>
Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/kernel/printk.c b/kernel/printk.c
index 572730bd8a5c..a2276b916769 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -880,7 +880,9 @@ static int syslog_print(char __user *buf, int size)
 	syslog_seq++;
 	raw_spin_unlock_irq(&logbuf_lock);
 
-	if (len > 0 && copy_to_user(buf, text, len))
+	if (len > size)
+		len = -EINVAL;
+	else if (len > 0 && copy_to_user(buf, text, len))
 		len = -EFAULT;
 
 	kfree(text);