syslogd klog read size

[Alexander Bluhm]

Hi,

When the kernel message buffer overflows, a message is printed by
syslogd and the buffer is overwritten.  The log file looks like
this:

Dec 23 22:20:54 q70 /bsd: klog: dropped 5687 bytes, message buffer full
Dec 23 22:20:54 q70 /bsd: rch, if=vio1: TCP wire: (0) 
fdd7:e83e:66bc:210::17[27871] fdd7:e83e:66bc:213::72[7]

But after a full message buffer is read, we get a split line.

Dec 23 22:20:55 q70 /bsd: pf: key search, if=vio1: ICMPv6 wire: (0) fdd7:e83e:
Dec 23 22:20:55 q70 /bsd: 66bc:211::17[24240] fdd7:e83e:66bc:213::72[128]

This happens when syslogd does a partial read which ends within a
line.  To avoid the latter, syslogd has to reserve space for the
kernel message buffer plus the buffer full message.

ok?

bluhm

Index: usr.sbin/syslogd/syslogd.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/usr.sbin/syslogd/syslogd.c,v
retrieving revision 1.223
diff -u -p -r1.223 syslogd.c
--- usr.sbin/syslogd/syslogd.c  30 Nov 2016 07:59:04 -0000      1.223
+++ usr.sbin/syslogd/syslogd.c  23 Dec 2016 22:04:17 -0000
@@ -489,7 +489,8 @@ main(int argc, char *argv[])
        } else
                LocalDomain = "";
 
-       linesize = getmsgbufsize();
+       /* Reserve space for kernel message buffer plus buffer full message. */
+       linesize = getmsgbufsize() + 64;
        if (linesize < MAXLINE)
                linesize = MAXLINE;
        linesize++;