summaryrefslogtreecommitdiff
path: root/kernel/printk.c
diff options
context:
space:
mode:
authorYuanhan Liu <yuanhan.liu@linux.intel.com>2012-06-16 08:40:55 +0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-06-16 19:36:03 +0400
commitb56a39ac263e5b8cafedd551a49c2105e68b98c2 (patch)
tree0dbbe8929783ab347b3d40d4ed79ea87d5b3966d /kernel/printk.c
parent4a77a5a06ec66ed05199b301e7c25f42f979afdc (diff)
downloadlinux-b56a39ac263e5b8cafedd551a49c2105e68b98c2.tar.xz
printk: return -EINVAL if the message len is bigger than the buf size
Just like what devkmsg_read() does, return -EINVAL if the message len is bigger than the buf size, or it will trigger a segfault error. Acked-by: Kay Sievers <kay@vrfy.org> Acked-by: Fengguang Wu <wfg@linux.intel.com> Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel/printk.c')
-rw-r--r--kernel/printk.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/kernel/printk.c b/kernel/printk.c
index 572730bd8a5c..a2276b916769 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -880,7 +880,9 @@ static int syslog_print(char __user *buf, int size)
syslog_seq++;
raw_spin_unlock_irq(&logbuf_lock);
- if (len > 0 && copy_to_user(buf, text, len))
+ if (len > size)
+ len = -EINVAL;
+ else if (len > 0 && copy_to_user(buf, text, len))
len = -EFAULT;
kfree(text);