From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.3 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C856C47076 for ; Fri, 21 May 2021 14:27:38 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id C46356135A for ; Fri, 21 May 2021 14:27:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C46356135A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 489AB82E23; Fri, 21 May 2021 16:27:35 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=konsulko.com header.i=@konsulko.com header.b="oil/HiRf"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 3B45382CFE; Fri, 21 May 2021 16:27:33 +0200 (CEST) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id B438382CFE for ; Fri, 21 May 2021 16:27:29 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=trini@konsulko.com Received: by mail-qk1-x735.google.com with SMTP id k4so8770526qkd.0 for ; Fri, 21 May 2021 07:27:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=8NZLUorJ2I4hzdhjFrPTxGFK9KCCS1w/k3M+CsVUIsk=; b=oil/HiRftTcWyQXgoBZEDueVNtfvEBgEdOIuHRga8p/1UIIFCVnXAN/fEffqz+9TOm uO1KhvZM9Vnc/UUa23T2Ob39Cy87VyV0DnTPa7dxB3xVoFY3qATFLDHMz/BtcDEAC+Ic BihUGj+y937uQEPatm/lzn8eCxajAJnDpauF4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=8NZLUorJ2I4hzdhjFrPTxGFK9KCCS1w/k3M+CsVUIsk=; b=WUu0YcKsvJpp8q7kuv2DzMoOuTHmYjErE8/+io10rwXeV/QoT7hqb4oWzC7XnQ81aW w67/ELeVUv4cHI4EL5/wQ+3A8/ARjVkXpKSJFnv6ah1vz76VIkHvV8lUBYYd74hOGV1I UiDM8UacuY8EHYO2EthVljoeN9jI+msPAGLOiif9ghpCqneNVIT501hbdBErd+3+RhyY FpeC8pB1vzvMeEQFMT8rUElHBz9Se8wM4U+LmjZaf9Y0XXD0UJgRoV7zsW4fO+BpVWve 3qrTRL0IRaug4xFx6h50B1Ngo4pn1gXjofXQ4IuHipkrawH98NaH6eL++YGjGwJVBdgr ulIA== X-Gm-Message-State: AOAM533talAPOZx74LPJZt0AQWIIb/tu6lRwoHtsJcOufUEi+9azbZ6d aU060Ln2A+TMPuvJC1QrcK+0nw== X-Google-Smtp-Source: ABdhPJyU8ax8HC6m9cWhJerlJqSpS5Xdf/lFidu8/VUnfWSULttYjkTt1tc63QgIN8LCSvYVvnFUEQ== X-Received: by 2002:a05:620a:2114:: with SMTP id l20mr12407051qkl.51.1621607248668; Fri, 21 May 2021 07:27:28 -0700 (PDT) Received: from bill-the-cat (2603-6081-7b01-cbda-d93e-00f7-042d-0dde.res6.spectrum.com. [2603:6081:7b01:cbda:d93e:f7:42d:dde]) by smtp.gmail.com with ESMTPSA id r10sm5235497qke.9.2021.05.21.07.27.27 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 21 May 2021 07:27:27 -0700 (PDT) Date: Fri, 21 May 2021 10:27:26 -0400 From: Tom Rini To: Heinrich Schuchardt Cc: Rasmus Villemoes , U-Boot Mailing List , Simon Glass Subject: Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value Message-ID: <20210521142726.GH17669@bill-the-cat> References: <20210520100528.322846-1-rasmus.villemoes@prevas.dk> <20210520100528.322846-2-rasmus.villemoes@prevas.dk> <6d1761b1-5129-d5a1-24ba-a27d15c42198@gmx.de> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="mEPXDR2wTV4RNGRv" Content-Disposition: inline In-Reply-To: <6d1761b1-5129-d5a1-24ba-a27d15c42198@gmx.de> X-Clacks-Overhead: GNU Terry Pratchett User-Agent: Mutt/1.9.4 (2018-02-28) X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.4 at phobos.denx.de X-Virus-Status: Clean --mEPXDR2wTV4RNGRv Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, May 21, 2021 at 04:15:39PM +0200, Heinrich Schuchardt wrote: > On 21.05.21 14:53, Rasmus Villemoes wrote: > > On 20/05/2021 19.51, Simon Glass wrote: > >> Hi Rasmus, > >> > >> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes > >> wrote: > >>> > >>> Most callers (or callers of callers, etc.) of vsnprintf() are not > >>> prepared for it to return a negative value. > >>> > >>> The only case where that can currently happen is %pD, and it's IMO > >>> more user-friendly to produce some output that clearly shows that some > >>> "impossible" thing happened instead of having the message completely > >>> ignored - or mishandled as for example log.c would currently do. > >>> > >>> Signed-off-by: Rasmus Villemoes > >>> --- > >>> lib/vsprintf.c | 10 +--------- > >>> 1 file changed, 1 insertion(+), 9 deletions(-) > >> > >> I think that is debatable. If we want the calling code to be fixed, > >> then it needs to get an error code back. Otherwise the error will be > >> apparent to the user but (perhaps) not ever debugged. > > > > But it is not the calling code that is at fault for the vsnprintf() > > implementation (1) being able to fail and (2) actually encountering an > > ENOMEM situation. There's _nothing_ the calling code can do about that. >=20 > include/vsnprintf.h states: >=20 > "This function follows C99 vsnprintf, but has some extensions:". >=20 > The C99 spec says: >=20 > "The vsnprintf function returns the number of characters that would have > been written had n been sufficiently large, not counting the > terminating null character, or a negative value if an encoding error > occurred." >=20 > It is obvious that the calling code needs to be fixed if it cannot > handle negative return values. >=20 > So NAK to the patch. >=20 > Best regards >=20 > Heinrich >=20 > > > > The calling code can be said to be responsible for not passing NULL > > pointers, but that case is actually handled gracefully in various places > > in the printf code (both for %pD, but also plain %s). > > > >> The definition of printf() allows for the possibility of a negative > >> return value. > > > > First, please distinguish printf() from vsnprintf(). The former (in the > > normal userspace version) obviously can fail for the obvious EIO, ENOSPC > > reasons. The latter is indeed allowed to fail per the posix spec, but > > from a QoI perspective, I'd say it's much better to have a guarantee > > _for our particular implementation_ that it does not fail (meaning: > > returns a negative result). There's simply too many direct and indirect > > users of vsnprintf() that assume the result is non-negative; if we do > > not provide that guarantee, the alternative is to play a whack-a-mole > > game and add tons of error-checking code (adding bloat to the image), > > with almost never any good way to handle it. > > > > Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so > > that it ignores the message if vsnprintf (or vscnprintf, whatever) > > returns a negative result, just as print() currently does [which is the > > other thing that log_info could end up being handled by]. That means > > nothing gets printed on the console, and nobody gets told about the > > ENOMEM. In contrast, with this patch, we get > > > > Booting <%pD:ENOMEM> > > > > printed on the console, so at least _some_ part of the message gets out, > > and it's apparent that something odd happened. Of course, all of that is > > in the entirely unlikely sitation where the (efi) allocation would > > actually fail. > > > > If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should > > ensure vsnprintf returns non-negative; e.g. by changing the "return > > PTR_ERR()" to a "goto out", i.e. simply stop the processing of the > > format string at the %pD which failed, but still go through the epilogue > > that ensures the resulting string becomes nul-terminated (another > > reasonable assumption made by tons of callers), and return how much got > > printed till then. So, how can we fix the callers without the above noted problems? --=20 Tom --mEPXDR2wTV4RNGRv Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmCnw0oACgkQFHw5/5Y0 tyzpFgv5AZ8wGEf1RDtPWzo/wrrinxwgt9q6K993iBlf5DoYoEe7owp3LBOfw7Mt jRCUtDZdxgmTPq1cUJ72El3DXuJei+ayx8XNplhNJOfb6ezpe9lCyuPW6bBye+jU i1CjtBlfnfPaWxzo0MCubmstVwTsHN/En/2AT/Z0XudxktasVEWBwKyWSIoSikC1 fiydzBTrmae8poZYd6i+nWEvM7Qxwv3qT6iB6TWC3yBdVXIfbTB7QInJPmZw/VKU V5w7J07OPBdr5iKZUSBR6bwExnjygS1SFE9Ws6cCOhIID+JPBukeWSBSSpBZMn3W 1xqlX4A0TiLUS8KKJ2/8trjrX/xgfwss4+XUe3HGhaTXoVMmR122q7vIF5eLQOlX jvrN2ckgZ+cIgmGkXR7XC6pHCqKlqFeOolMWe0k/BM8cNCXLNDt3T5Ocgx0irFeU btX/zAmEU73l07WkjJzDLcW0ymUpbTjuIzsVhDaJ4z6SXjyxhs4qPpCwSVamFHpY ykjoha9v =VsLw -----END PGP SIGNATURE----- --mEPXDR2wTV4RNGRv--