logger: fix temporary buffer handling

Prevent writing beyond temporary buffer and improve accumulation of data
before receiving a newline character or filling the buffer.

Change-Id: I8e0591c90914dbd4c2addde4247157831fa4843a
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>

diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c
index e547e41..197b9c5 100644 (file)
--- a/drivers/staging/android/logger.c
+++ b/drivers/staging/android/logger.c
@@ -593,6 +593,7 @@ static ssize_t logger_write_iter(struct kiocb *iocb, struct iov_iter *from)
        if (from_stdio) {
                char *p;
                size_t chunk_len = 0;
+               /* -2 : priority byte and tag terminating '\0' */
                size_t max_payload = LOGGER_ENTRY_MAX_PAYLOAD - writer->tag_len - 2;
 
                if (writer->owner != current->group_leader) {
@@ -623,7 +624,9 @@ static ssize_t logger_write_iter(struct kiocb *iocb, struct iov_iter *from)
                if (writer->b_owner != current && writer->b_off)
                        flush_thread_data(file);
 
-               count = min_t(size_t, iov_iter_count(from), max_payload - 1);
+               /* -1 : leave space for message terminating '\0' */
+               count = min_t(size_t, iov_iter_count(from),
+                             max_payload - writer->b_off - 1);
 
                do {
 
@@ -638,8 +641,16 @@ static ssize_t logger_write_iter(struct kiocb *iocb, struct iov_iter *from)
                                *p++ = '\0';
                                chunk_len = p - writer->buffer;
                        } else {
-                               writer->buffer[count++] = '\0';
-                               chunk_len = count;
+                               writer->buffer[writer->b_off + count++] = '\0';
+                               p = &writer->buffer[writer->b_off + count];
+                               chunk_len = p - writer->buffer;
+
+                               BUG_ON(chunk_len > max_payload);
+                               if (chunk_len < max_payload ) {
+                                       writer->b_off = writer->b_off + count - 1;
+                                       continue;
+                               }
+
                        }
 
                        header.len = chunk_len + writer->tag_len + 2;