From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.3 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19A8FC433ED for ; Fri, 21 May 2021 14:16:16 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 3D4246101B for ; Fri, 21 May 2021 14:16:15 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3D4246101B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmx.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 13C6682E49; Fri, 21 May 2021 16:16:13 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=gmx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; secure) header.d=gmx.net header.i=@gmx.net header.b="VsuwcHmg"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id B8C0E82E41; Fri, 21 May 2021 16:16:11 +0200 (CEST) Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id AE0F182E41 for ; Fri, 21 May 2021 16:16:08 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=xypron.glpk@gmx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1621606565; bh=bNDf4psSo2Xcd+Z86FiCNmNpV6B7I8ZwE8QooKdhb78=; h=X-UI-Sender-Class:Subject:To:Cc:References:From:Date:In-Reply-To; b=VsuwcHmgt0SFDJU9L+ghti4Z6h/aklWSDnbxBaTSU2WR0+5C9z2FzGTrUyVNiebL6 lm8Nk8Mxy+4AYLHwN155fcz98u72RUjHgGiLWaAnZ0zvsNvNb7cQBvWaUWDF7z2q9a 6fhid2D5urh8fTT0irsY7WyDn1BD3qN3AnBq5wUM= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from [192.168.123.70] ([62.143.247.63]) by mail.gmx.net (mrgmx105 [212.227.17.168]) with ESMTPSA (Nemesis) id 1MYvcG-1lxHEq3bKS-00UuDi; Fri, 21 May 2021 16:16:04 +0200 Subject: Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value To: Rasmus Villemoes Cc: U-Boot Mailing List , Tom Rini , Simon Glass References: <20210520100528.322846-1-rasmus.villemoes@prevas.dk> <20210520100528.322846-2-rasmus.villemoes@prevas.dk> From: Heinrich Schuchardt Message-ID: <6d1761b1-5129-d5a1-24ba-a27d15c42198@gmx.de> Date: Fri, 21 May 2021 16:15:39 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:uSfr6ozFr8IdWfiONC80FM3RR1FuG+3Mr3VTUJ7mV357wkUdkcz 0hhNGHkRTJ7BsUyzbpuHjxl1ZslnSykQdOgFZuydi3pOwQbNc0QexrO8YYdokERcDETUR9Z 6E/P6ssM8zeOD5YX2prMaG52ecNhO9zaTLM/JiPyGB1PDIq1YYgy5KaJduqaQ69/m0/KW0c pnC9eM8mt+0DWIiEd7VbA== X-UI-Out-Filterresults: notjunk:1;V03:K0:mwHrs6C7cv4=:nEoVRpprAVp95rHAaMGmzb ONaujLuV+6wkqF5Fx+2VTgP6r2lUw6aXOF46oMvOc8dh3X0Of24O9E+q95AeQMFNG2cJ1gXHd UebGPKMluJEmPrxhdkQRfv/uxaVfkjKmJDzrSlxwQ6Is840CLhSeYiVgyGyQHFtILxyKjJfXV t0NnJRQvr1jPvuDQAMflNpKoh6E7lANUBAB8EV52sCD86s7cYlkleiIvjwWvWPEyXoIFBRjkb slZo6pdHpLGYgrFBESNNfOerkk9EfDQJ9CpXQayTnXD18icAkMgigY1HtdRZiMD9BtRLdPr5/ nNI9e5Ru5WsfVmylrWCdJwV8ILxTrCSh0X8XETROuXIXl0VkR2Kddgd/fMicXu3UWwpUNe9ko 5meDVqwtpqnV/YOI8BYi4QZDtFNKkCb4dY/g1RehFpD9qmqI5EbQTMuHcxOQv0OgVke6WjtOc lq+aTS4c6tb5wWZiMsq/asB1v1GQU8cRaE62o1u9LH1YNw4oqLf/aMJr6X5HjT8p3cH3ANrm2 hCXnu99mPHZA7KAP6jWm9CM8/2Rx1rEoSvAJfifJvTTx2WaORHbf6M6wV+wHcVoAvDw5ZrLbo ZVwRwu72WwJ31FgyMiElmeR8e0aIty6IJAzvPhOjp1h2kZLMru2TUZdZq25kKA4gWWFuLDfLG QzKTTqguWHLbUxGJYeJsj2W7KL3GzaPrIDPdw9xlz8OWS8FuisvUg6nny/jvYCVwSlwiNFRKu EBMT6q2HSUURCvNbtlyEiq+cXTseRRjhlUmT3px8FSZu2BPodcwpo7Ag3ZZkV8S1JVRPyeM4O sL8kC/5Ld1ryXTikMjS0MKaPbzAmce2ZxHshiIfB/nuP0LVs2qS3IalaWHv/RVx/Z8xnBngnW +I4VwYiCh58iIi0cskBMKnXrTVbYm5aBWFcDttU3qGS5+2qQNi9M4E8bmW0QLgu2fnjoFk4qw yiallMwxzbJ0Eb94fCqyMk32Eaht0M7GNXpoSAvxwLiQw4x6TDwWuOXpkScW2+s02l/c+d1/V ybqGfzwxysQKRIPoadJ4Z7M3lkoiCUy5fBcWxVOZRU/na6++L/cVkPD9tAJLUfLPP4hjuX8pd MYUgndzOVgs1YE5lqlvd343exV6k/y9RQoG X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.4 at phobos.denx.de X-Virus-Status: Clean On 21.05.21 14:53, Rasmus Villemoes wrote: > On 20/05/2021 19.51, Simon Glass wrote: >> Hi Rasmus, >> >> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes >> wrote: >>> >>> Most callers (or callers of callers, etc.) of vsnprintf() are not >>> prepared for it to return a negative value. >>> >>> The only case where that can currently happen is %pD, and it's IMO >>> more user-friendly to produce some output that clearly shows that some >>> "impossible" thing happened instead of having the message completely >>> ignored - or mishandled as for example log.c would currently do. >>> >>> Signed-off-by: Rasmus Villemoes >>> --- >>> lib/vsprintf.c | 10 +--------- >>> 1 file changed, 1 insertion(+), 9 deletions(-) >> >> I think that is debatable. If we want the calling code to be fixed, >> then it needs to get an error code back. Otherwise the error will be >> apparent to the user but (perhaps) not ever debugged. > > But it is not the calling code that is at fault for the vsnprintf() > implementation (1) being able to fail and (2) actually encountering an > ENOMEM situation. There's _nothing_ the calling code can do about that. include/vsnprintf.h states: "This function follows C99 vsnprintf, but has some extensions:". The C99 spec says: "The vsnprintf function returns the number of characters that would have been written had n been sufficiently large, not counting the terminating null character, or a negative value if an encoding error occurred." It is obvious that the calling code needs to be fixed if it cannot handle negative return values. So NAK to the patch. Best regards Heinrich > > The calling code can be said to be responsible for not passing NULL > pointers, but that case is actually handled gracefully in various places > in the printf code (both for %pD, but also plain %s). > >> The definition of printf() allows for the possibility of a negative >> return value. > > First, please distinguish printf() from vsnprintf(). The former (in the > normal userspace version) obviously can fail for the obvious EIO, ENOSPC > reasons. The latter is indeed allowed to fail per the posix spec, but > from a QoI perspective, I'd say it's much better to have a guarantee > _for our particular implementation_ that it does not fail (meaning: > returns a negative result). There's simply too many direct and indirect > users of vsnprintf() that assume the result is non-negative; if we do > not provide that guarantee, the alternative is to play a whack-a-mole > game and add tons of error-checking code (adding bloat to the image), > with almost never any good way to handle it. > > Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so > that it ignores the message if vsnprintf (or vscnprintf, whatever) > returns a negative result, just as print() currently does [which is the > other thing that log_info could end up being handled by]. That means > nothing gets printed on the console, and nobody gets told about the > ENOMEM. In contrast, with this patch, we get > > Booting <%pD:ENOMEM> > > printed on the console, so at least _some_ part of the message gets out, > and it's apparent that something odd happened. Of course, all of that is > in the entirely unlikely sitation where the (efi) allocation would > actually fail. > > If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should > ensure vsnprintf returns non-negative; e.g. by changing the "return > PTR_ERR()" to a "goto out", i.e. simply stop the processing of the > format string at the %pD which failed, but still go through the epilogue > that ensures the resulting string becomes nul-terminated (another > reasonable assumption made by tons of callers), and return how much got > printed till then. > > Rasmus >