All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/5] assorted printf-related patches
@ 2021-05-20 10:05 Rasmus Villemoes
  2021-05-20 10:05 ` [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value Rasmus Villemoes
                   ` (4 more replies)
  0 siblings, 5 replies; 22+ messages in thread
From: Rasmus Villemoes @ 2021-05-20 10:05 UTC (permalink / raw)
  To: u-boot

The first patch ensures that vsnprintf() never returns a negative
value. Finding (indirect) callers and having them all handle that
would be a whack-a-mole game for no real gain. Even if the callers
don't directly use the return value, they might rely on vsnprintf()
always producing a nul-terminated string, which is not the case if we
do an early "return -Esomething".

The last fixes a bug I found while looking for impact of %pD returning
a negative value.

The second and fourth reduce the size of vsprintf.o a little.

Rasmus Villemoes (5):
  lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  lib/vsprintf.c: implement printf() in terms of vprintf()
  lib/vsprintf.c: remove stale comment
  lib/vsprintf.c: remove unused ip6_addr_string()
  common/log.c: use vscnprintf() in log_dispatch()

 common/log.c   |  2 +-
 lib/vsprintf.c | 28 ++++++----------------------
 2 files changed, 7 insertions(+), 23 deletions(-)

-- 
2.29.2

^ permalink raw reply	[flat|nested] 22+ messages in thread

* [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-20 10:05 [PATCH 0/5] assorted printf-related patches Rasmus Villemoes
@ 2021-05-20 10:05 ` Rasmus Villemoes
  2021-05-20 17:51   ` Simon Glass
  2021-05-20 10:05 ` [PATCH 2/5] lib/vsprintf.c: implement printf() in terms of vprintf() Rasmus Villemoes
                   ` (3 subsequent siblings)
  4 siblings, 1 reply; 22+ messages in thread
From: Rasmus Villemoes @ 2021-05-20 10:05 UTC (permalink / raw)
  To: u-boot

Most callers (or callers of callers, etc.) of vsnprintf() are not
prepared for it to return a negative value.

The only case where that can currently happen is %pD, and it's IMO
more user-friendly to produce some output that clearly shows that some
"impossible" thing happened instead of having the message completely
ignored - or mishandled as for example log.c would currently do.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
---
 lib/vsprintf.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 9dc96c81c6..0050110683 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -310,7 +310,7 @@ static char *device_path_string(char *buf, char *end, void *dp, int field_width,
 
 	str = efi_dp_str((struct efi_device_path *)dp);
 	if (!str)
-		return ERR_PTR(-ENOMEM);
+		return string(buf, end, "<%pD:ENOMEM>", field_width, precision, flags);
 
 	buf = string16(buf, end, str, field_width, precision, flags);
 	efi_free_pool(str);
@@ -631,8 +631,6 @@ repeat:
 			str = pointer(fmt + 1, str, end,
 					va_arg(args, void *),
 					field_width, precision, flags);
-			if (IS_ERR(str))
-				return PTR_ERR(str);
 			/* Skip all alphanumeric pointer suffixes */
 			while (isalnum(fmt[1]))
 				fmt++;
@@ -798,9 +796,6 @@ int printf(const char *fmt, ...)
 	i = vscnprintf(printbuffer, sizeof(printbuffer), fmt, args);
 	va_end(args);
 
-	/* Handle error */
-	if (i <= 0)
-		return i;
 	/* Print the string */
 	puts(printbuffer);
 	return i;
@@ -817,9 +812,6 @@ int vprintf(const char *fmt, va_list args)
 	 */
 	i = vscnprintf(printbuffer, sizeof(printbuffer), fmt, args);
 
-	/* Handle error */
-	if (i <= 0)
-		return i;
 	/* Print the string */
 	puts(printbuffer);
 	return i;
-- 
2.29.2

^ permalink raw reply related	[flat|nested] 22+ messages in thread

* [PATCH 2/5] lib/vsprintf.c: implement printf() in terms of vprintf()
  2021-05-20 10:05 [PATCH 0/5] assorted printf-related patches Rasmus Villemoes
  2021-05-20 10:05 ` [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value Rasmus Villemoes
@ 2021-05-20 10:05 ` Rasmus Villemoes
  2021-05-20 17:51   ` Simon Glass
  2021-05-20 10:05 ` [PATCH 3/5] lib/vsprintf.c: remove stale comment Rasmus Villemoes
                   ` (2 subsequent siblings)
  4 siblings, 1 reply; 22+ messages in thread
From: Rasmus Villemoes @ 2021-05-20 10:05 UTC (permalink / raw)
  To: u-boot

This saves some code, both in terms of #LOC and .text size, and it is
also the normal convention that foo(...) is implemented in terms of
vfoo().

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
---
 lib/vsprintf.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 0050110683..e3bec7489b 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -785,19 +785,11 @@ int printf(const char *fmt, ...)
 {
 	va_list args;
 	uint i;
-	char printbuffer[CONFIG_SYS_PBSIZE];
 
 	va_start(args, fmt);
-
-	/*
-	 * For this to work, printbuffer must be larger than
-	 * anything we ever want to print.
-	 */
-	i = vscnprintf(printbuffer, sizeof(printbuffer), fmt, args);
+	i = vprintf(fmt, args);
 	va_end(args);
 
-	/* Print the string */
-	puts(printbuffer);
 	return i;
 }
 
-- 
2.29.2

^ permalink raw reply related	[flat|nested] 22+ messages in thread

* [PATCH 3/5] lib/vsprintf.c: remove stale comment
  2021-05-20 10:05 [PATCH 0/5] assorted printf-related patches Rasmus Villemoes
  2021-05-20 10:05 ` [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value Rasmus Villemoes
  2021-05-20 10:05 ` [PATCH 2/5] lib/vsprintf.c: implement printf() in terms of vprintf() Rasmus Villemoes
@ 2021-05-20 10:05 ` Rasmus Villemoes
  2021-05-20 17:51   ` Simon Glass
  2021-05-21 14:22   ` Heinrich Schuchardt
  2021-05-20 10:05 ` [PATCH 4/5] lib/vsprintf.c: remove unused ip6_addr_string() Rasmus Villemoes
  2021-05-20 10:05 ` [PATCH 5/5] common/log.c: use vscnprintf() in log_dispatch() Rasmus Villemoes
  4 siblings, 2 replies; 22+ messages in thread
From: Rasmus Villemoes @ 2021-05-20 10:05 UTC (permalink / raw)
  To: u-boot

U-Boot doesn't support %pS/%pF or any other kind of kallsyms-like
lookups. Remove the comment.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
---
 lib/vsprintf.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index e3bec7489b..65d985982d 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -434,9 +434,6 @@ static char *uuid_string(char *buf, char *end, u8 *addr, int field_width,
  * - 'i' [46] for 'raw' IPv4/IPv6 addresses, IPv6 omits the colons, IPv4 is
  *       currently the same
  *
- * Note: The difference between 'S' and 'F' is that on ia64 and ppc64
- * function pointers are really function descriptors, which contain a
- * pointer to the real address.
  */
 static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
 		int field_width, int precision, int flags)
-- 
2.29.2

^ permalink raw reply related	[flat|nested] 22+ messages in thread

* [PATCH 4/5] lib/vsprintf.c: remove unused ip6_addr_string()
  2021-05-20 10:05 [PATCH 0/5] assorted printf-related patches Rasmus Villemoes
                   ` (2 preceding siblings ...)
  2021-05-20 10:05 ` [PATCH 3/5] lib/vsprintf.c: remove stale comment Rasmus Villemoes
@ 2021-05-20 10:05 ` Rasmus Villemoes
  2021-05-20 17:51   ` Simon Glass
  2021-05-21 14:32   ` Heinrich Schuchardt
  2021-05-20 10:05 ` [PATCH 5/5] common/log.c: use vscnprintf() in log_dispatch() Rasmus Villemoes
  4 siblings, 2 replies; 22+ messages in thread
From: Rasmus Villemoes @ 2021-05-20 10:05 UTC (permalink / raw)
  To: u-boot

There's currently no user of %p[iI]6, so including ip6_addr_string()
in the image is a waste of bytes. It's easy enough to have the
compiler elide it without removing the code completely.

The closest I can find to anybody "handling" ipv6 in U-Boot currently
is in efi_net.c which does

        if (ipv6) {
                ret = EFI_UNSUPPORTED;

As indicated in the comment, it can easily be put back, but preferably
under a config knob.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
---
 lib/vsprintf.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 65d985982d..6742b0985a 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -434,6 +434,9 @@ static char *uuid_string(char *buf, char *end, u8 *addr, int field_width,
  * - 'i' [46] for 'raw' IPv4/IPv6 addresses, IPv6 omits the colons, IPv4 is
  *       currently the same
  *
+ * Note: IPv6 support is currently if(0)'ed out. If you ever need
+ * %pI6, please add an IPV6 Kconfig knob, make your code select or
+ * depend on that, and change the 0 below to CONFIG_IS_ENABLED(IPV6).
  */
 static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
 		int field_width, int precision, int flags)
@@ -478,7 +481,7 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
 		flags |= SPECIAL;
 		/* Fallthrough */
 	case 'I':
-		if (fmt[1] == '6')
+		if (0 && fmt[1] == '6')
 			return ip6_addr_string(buf, end, ptr, field_width,
 					       precision, flags);
 		if (fmt[1] == '4')
-- 
2.29.2

^ permalink raw reply related	[flat|nested] 22+ messages in thread

* [PATCH 5/5] common/log.c: use vscnprintf() in log_dispatch()
  2021-05-20 10:05 [PATCH 0/5] assorted printf-related patches Rasmus Villemoes
                   ` (3 preceding siblings ...)
  2021-05-20 10:05 ` [PATCH 4/5] lib/vsprintf.c: remove unused ip6_addr_string() Rasmus Villemoes
@ 2021-05-20 10:05 ` Rasmus Villemoes
  2021-05-20 17:51   ` Simon Glass
  4 siblings, 1 reply; 22+ messages in thread
From: Rasmus Villemoes @ 2021-05-20 10:05 UTC (permalink / raw)
  To: u-boot

We have to use the *printf variant which returns the strlen() of the
resulting string, not the
how-much-would-have-been-printed-given-enough-space, in order to use
that value to inspect the last character in the string.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
---
 common/log.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/log.c b/common/log.c
index ea407c6db9..cba8df5caa 100644
--- a/common/log.c
+++ b/common/log.c
@@ -220,7 +220,7 @@ static int log_dispatch(struct log_rec *rec, const char *fmt, va_list args)
 			if (!rec->msg) {
 				int len;
 
-				len = vsnprintf(buf, sizeof(buf), fmt, args);
+				len = vscnprintf(buf, sizeof(buf), fmt, args);
 				rec->msg = buf;
 				gd->log_cont = len && buf[len - 1] != '\n';
 			}
-- 
2.29.2

^ permalink raw reply related	[flat|nested] 22+ messages in thread

* [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-20 10:05 ` [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value Rasmus Villemoes
@ 2021-05-20 17:51   ` Simon Glass
  2021-05-21 12:53     ` Rasmus Villemoes
  0 siblings, 1 reply; 22+ messages in thread
From: Simon Glass @ 2021-05-20 17:51 UTC (permalink / raw)
  To: u-boot

Hi Rasmus,

On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
<rasmus.villemoes@prevas.dk> wrote:
>
> Most callers (or callers of callers, etc.) of vsnprintf() are not
> prepared for it to return a negative value.
>
> The only case where that can currently happen is %pD, and it's IMO
> more user-friendly to produce some output that clearly shows that some
> "impossible" thing happened instead of having the message completely
> ignored - or mishandled as for example log.c would currently do.
>
> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
> ---
>  lib/vsprintf.c | 10 +---------
>  1 file changed, 1 insertion(+), 9 deletions(-)

I think that is debatable. If we want the calling code to be fixed,
then it needs to get an error code back. Otherwise the error will be
apparent to the user but (perhaps) not ever debugged.

The definition of printf() allows for the possibility of a negative
return value. We should add a prototype to vsprintf.h to indicate this
as the only existing one (in exports.h) has no comment.


>
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index 9dc96c81c6..0050110683 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -310,7 +310,7 @@ static char *device_path_string(char *buf, char *end, void *dp, int field_width,
>
>         str = efi_dp_str((struct efi_device_path *)dp);
>         if (!str)
> -               return ERR_PTR(-ENOMEM);
> +               return string(buf, end, "<%pD:ENOMEM>", field_width, precision, flags);
>
>         buf = string16(buf, end, str, field_width, precision, flags);
>         efi_free_pool(str);
> @@ -631,8 +631,6 @@ repeat:
>                         str = pointer(fmt + 1, str, end,
>                                         va_arg(args, void *),
>                                         field_width, precision, flags);
> -                       if (IS_ERR(str))
> -                               return PTR_ERR(str);
>                         /* Skip all alphanumeric pointer suffixes */
>                         while (isalnum(fmt[1]))
>                                 fmt++;
> @@ -798,9 +796,6 @@ int printf(const char *fmt, ...)
>         i = vscnprintf(printbuffer, sizeof(printbuffer), fmt, args);
>         va_end(args);
>
> -       /* Handle error */
> -       if (i <= 0)
> -               return i;
>         /* Print the string */
>         puts(printbuffer);
>         return i;
> @@ -817,9 +812,6 @@ int vprintf(const char *fmt, va_list args)
>          */
>         i = vscnprintf(printbuffer, sizeof(printbuffer), fmt, args);
>
> -       /* Handle error */
> -       if (i <= 0)
> -               return i;
>         /* Print the string */
>         puts(printbuffer);
>         return i;
> --
> 2.29.2
>

^ permalink raw reply	[flat|nested] 22+ messages in thread

* [PATCH 2/5] lib/vsprintf.c: implement printf() in terms of vprintf()
  2021-05-20 10:05 ` [PATCH 2/5] lib/vsprintf.c: implement printf() in terms of vprintf() Rasmus Villemoes
@ 2021-05-20 17:51   ` Simon Glass
  0 siblings, 0 replies; 22+ messages in thread
From: Simon Glass @ 2021-05-20 17:51 UTC (permalink / raw)
  To: u-boot

On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
<rasmus.villemoes@prevas.dk> wrote:
>
> This saves some code, both in terms of #LOC and .text size, and it is
> also the normal convention that foo(...) is implemented in terms of
> vfoo().
>
> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
> ---
>  lib/vsprintf.c | 10 +---------
>  1 file changed, 1 insertion(+), 9 deletions(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

^ permalink raw reply	[flat|nested] 22+ messages in thread

* [PATCH 3/5] lib/vsprintf.c: remove stale comment
  2021-05-20 10:05 ` [PATCH 3/5] lib/vsprintf.c: remove stale comment Rasmus Villemoes
@ 2021-05-20 17:51   ` Simon Glass
  2021-05-21 14:22   ` Heinrich Schuchardt
  1 sibling, 0 replies; 22+ messages in thread
From: Simon Glass @ 2021-05-20 17:51 UTC (permalink / raw)
  To: u-boot

On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
<rasmus.villemoes@prevas.dk> wrote:
>
> U-Boot doesn't support %pS/%pF or any other kind of kallsyms-like
> lookups. Remove the comment.
>
> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
> ---
>  lib/vsprintf.c | 3 ---
>  1 file changed, 3 deletions(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

^ permalink raw reply	[flat|nested] 22+ messages in thread

* [PATCH 4/5] lib/vsprintf.c: remove unused ip6_addr_string()
  2021-05-20 10:05 ` [PATCH 4/5] lib/vsprintf.c: remove unused ip6_addr_string() Rasmus Villemoes
@ 2021-05-20 17:51   ` Simon Glass
  2021-05-21 14:32   ` Heinrich Schuchardt
  1 sibling, 0 replies; 22+ messages in thread
From: Simon Glass @ 2021-05-20 17:51 UTC (permalink / raw)
  To: u-boot

On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
<rasmus.villemoes@prevas.dk> wrote:
>
> There's currently no user of %p[iI]6, so including ip6_addr_string()
> in the image is a waste of bytes. It's easy enough to have the
> compiler elide it without removing the code completely.
>
> The closest I can find to anybody "handling" ipv6 in U-Boot currently
> is in efi_net.c which does
>
>         if (ipv6) {
>                 ret = EFI_UNSUPPORTED;
>
> As indicated in the comment, it can easily be put back, but preferably
> under a config knob.
>
> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
> ---
>  lib/vsprintf.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

^ permalink raw reply	[flat|nested] 22+ messages in thread

* [PATCH 5/5] common/log.c: use vscnprintf() in log_dispatch()
  2021-05-20 10:05 ` [PATCH 5/5] common/log.c: use vscnprintf() in log_dispatch() Rasmus Villemoes
@ 2021-05-20 17:51   ` Simon Glass
  0 siblings, 0 replies; 22+ messages in thread
From: Simon Glass @ 2021-05-20 17:51 UTC (permalink / raw)
  To: u-boot

On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
<rasmus.villemoes@prevas.dk> wrote:
>
> We have to use the *printf variant which returns the strlen() of the
> resulting string, not the
> how-much-would-have-been-printed-given-enough-space, in order to use
> that value to inspect the last character in the string.
>
> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
> ---
>  common/log.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

But I think it should check for a -ve value too.

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-20 17:51   ` Simon Glass
@ 2021-05-21 12:53     ` Rasmus Villemoes
  2021-05-21 14:15       ` Heinrich Schuchardt
  0 siblings, 1 reply; 22+ messages in thread
From: Rasmus Villemoes @ 2021-05-21 12:53 UTC (permalink / raw)
  To: Simon Glass; +Cc: U-Boot Mailing List, Heinrich Schuchardt, Tom Rini

On 20/05/2021 19.51, Simon Glass wrote:
> Hi Rasmus,
> 
> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
> <rasmus.villemoes@prevas.dk> wrote:
>>
>> Most callers (or callers of callers, etc.) of vsnprintf() are not
>> prepared for it to return a negative value.
>>
>> The only case where that can currently happen is %pD, and it's IMO
>> more user-friendly to produce some output that clearly shows that some
>> "impossible" thing happened instead of having the message completely
>> ignored - or mishandled as for example log.c would currently do.
>>
>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
>> ---
>>  lib/vsprintf.c | 10 +---------
>>  1 file changed, 1 insertion(+), 9 deletions(-)
> 
> I think that is debatable. If we want the calling code to be fixed,
> then it needs to get an error code back. Otherwise the error will be
> apparent to the user but (perhaps) not ever debugged.

But it is not the calling code that is at fault for the vsnprintf()
implementation (1) being able to fail and (2) actually encountering an
ENOMEM situation. There's _nothing_ the calling code can do about that.

The calling code can be said to be responsible for not passing NULL
pointers, but that case is actually handled gracefully in various places
in the printf code (both for %pD, but also plain %s).

> The definition of printf() allows for the possibility of a negative
> return value.

First, please distinguish printf() from vsnprintf(). The former (in the
normal userspace version) obviously can fail for the obvious EIO, ENOSPC
reasons. The latter is indeed allowed to fail per the posix spec, but
from a QoI perspective, I'd say it's much better to have a guarantee
_for our particular implementation_ that it does not fail (meaning:
returns a negative result). There's simply too many direct and indirect
users of vsnprintf() that assume the result is non-negative; if we do
not provide that guarantee, the alternative is to play a whack-a-mole
game and add tons of error-checking code (adding bloat to the image),
with almost never any good way to handle it.

Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so
that it ignores the message if vsnprintf (or vscnprintf, whatever)
returns a negative result, just as print() currently does [which is the
other thing that log_info could end up being handled by]. That means
nothing gets printed on the console, and nobody gets told about the
ENOMEM. In contrast, with this patch, we get

  Booting <%pD:ENOMEM>

printed on the console, so at least _some_ part of the message gets out,
and it's apparent that something odd happened. Of course, all of that is
in the entirely unlikely sitation where the (efi) allocation would
actually fail.

If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should
ensure vsnprintf returns non-negative; e.g. by changing the "return
PTR_ERR()" to a "goto out", i.e. simply stop the processing of the
format string at the %pD which failed, but still go through the epilogue
that ensures the resulting string becomes nul-terminated (another
reasonable assumption made by tons of callers), and return how much got
printed till then.

Rasmus

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-21 12:53     ` Rasmus Villemoes
@ 2021-05-21 14:15       ` Heinrich Schuchardt
  2021-05-21 14:27         ` Tom Rini
                           ` (2 more replies)
  0 siblings, 3 replies; 22+ messages in thread
From: Heinrich Schuchardt @ 2021-05-21 14:15 UTC (permalink / raw)
  To: Rasmus Villemoes; +Cc: U-Boot Mailing List, Tom Rini, Simon Glass

On 21.05.21 14:53, Rasmus Villemoes wrote:
> On 20/05/2021 19.51, Simon Glass wrote:
>> Hi Rasmus,
>>
>> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
>> <rasmus.villemoes@prevas.dk> wrote:
>>>
>>> Most callers (or callers of callers, etc.) of vsnprintf() are not
>>> prepared for it to return a negative value.
>>>
>>> The only case where that can currently happen is %pD, and it's IMO
>>> more user-friendly to produce some output that clearly shows that some
>>> "impossible" thing happened instead of having the message completely
>>> ignored - or mishandled as for example log.c would currently do.
>>>
>>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
>>> ---
>>>  lib/vsprintf.c | 10 +---------
>>>  1 file changed, 1 insertion(+), 9 deletions(-)
>>
>> I think that is debatable. If we want the calling code to be fixed,
>> then it needs to get an error code back. Otherwise the error will be
>> apparent to the user but (perhaps) not ever debugged.
>
> But it is not the calling code that is at fault for the vsnprintf()
> implementation (1) being able to fail and (2) actually encountering an
> ENOMEM situation. There's _nothing_ the calling code can do about that.

include/vsnprintf.h states:

"This function follows C99 vsnprintf, but has some extensions:".

The C99 spec says:

"The vsnprintf function returns the number of characters that would have
been written had n been sufficiently large, not counting  the
terminating  null  character, or a negative value if an encoding error
occurred."

It is obvious that the calling code needs to be fixed if it cannot
handle negative return values.

So NAK to the patch.

Best regards

Heinrich

>
> The calling code can be said to be responsible for not passing NULL
> pointers, but that case is actually handled gracefully in various places
> in the printf code (both for %pD, but also plain %s).
>
>> The definition of printf() allows for the possibility of a negative
>> return value.
>
> First, please distinguish printf() from vsnprintf(). The former (in the
> normal userspace version) obviously can fail for the obvious EIO, ENOSPC
> reasons. The latter is indeed allowed to fail per the posix spec, but
> from a QoI perspective, I'd say it's much better to have a guarantee
> _for our particular implementation_ that it does not fail (meaning:
> returns a negative result). There's simply too many direct and indirect
> users of vsnprintf() that assume the result is non-negative; if we do
> not provide that guarantee, the alternative is to play a whack-a-mole
> game and add tons of error-checking code (adding bloat to the image),
> with almost never any good way to handle it.
>
> Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so
> that it ignores the message if vsnprintf (or vscnprintf, whatever)
> returns a negative result, just as print() currently does [which is the
> other thing that log_info could end up being handled by]. That means
> nothing gets printed on the console, and nobody gets told about the
> ENOMEM. In contrast, with this patch, we get
>
>   Booting <%pD:ENOMEM>
>
> printed on the console, so at least _some_ part of the message gets out,
> and it's apparent that something odd happened. Of course, all of that is
> in the entirely unlikely sitation where the (efi) allocation would
> actually fail.
>
> If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should
> ensure vsnprintf returns non-negative; e.g. by changing the "return
> PTR_ERR()" to a "goto out", i.e. simply stop the processing of the
> format string at the %pD which failed, but still go through the epilogue
> that ensures the resulting string becomes nul-terminated (another
> reasonable assumption made by tons of callers), and return how much got
> printed till then.
>
> Rasmus
>


^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 3/5] lib/vsprintf.c: remove stale comment
  2021-05-20 10:05 ` [PATCH 3/5] lib/vsprintf.c: remove stale comment Rasmus Villemoes
  2021-05-20 17:51   ` Simon Glass
@ 2021-05-21 14:22   ` Heinrich Schuchardt
  1 sibling, 0 replies; 22+ messages in thread
From: Heinrich Schuchardt @ 2021-05-21 14:22 UTC (permalink / raw)
  To: Rasmus Villemoes, u-boot; +Cc: Simon Glass, Tom Rini

On 20.05.21 12:05, Rasmus Villemoes wrote:
> U-Boot doesn't support %pS/%pF or any other kind of kallsyms-like
> lookups. Remove the comment.
>
> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
> ---
>  lib/vsprintf.c | 3 ---
>  1 file changed, 3 deletions(-)
>
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index e3bec7489b..65d985982d 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -434,9 +434,6 @@ static char *uuid_string(char *buf, char *end, u8 *addr, int field_width,
>   * - 'i' [46] for 'raw' IPv4/IPv6 addresses, IPv6 omits the colons, IPv4 is
>   *       currently the same

Please, rework the list above too.

Best regards

Heinrich

>   *
> - * Note: The difference between 'S' and 'F' is that on ia64 and ppc64
> - * function pointers are really function descriptors, which contain a
> - * pointer to the real address.
>   */
>  static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
>  		int field_width, int precision, int flags)
>


^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-21 14:15       ` Heinrich Schuchardt
@ 2021-05-21 14:27         ` Tom Rini
  2021-05-21 14:42           ` Heinrich Schuchardt
  2021-05-21 14:40         ` Rasmus Villemoes
  2021-05-21 14:48         ` Sean Anderson
  2 siblings, 1 reply; 22+ messages in thread
From: Tom Rini @ 2021-05-21 14:27 UTC (permalink / raw)
  To: Heinrich Schuchardt; +Cc: Rasmus Villemoes, U-Boot Mailing List, Simon Glass

[-- Attachment #1: Type: text/plain, Size: 4205 bytes --]

On Fri, May 21, 2021 at 04:15:39PM +0200, Heinrich Schuchardt wrote:
> On 21.05.21 14:53, Rasmus Villemoes wrote:
> > On 20/05/2021 19.51, Simon Glass wrote:
> >> Hi Rasmus,
> >>
> >> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
> >> <rasmus.villemoes@prevas.dk> wrote:
> >>>
> >>> Most callers (or callers of callers, etc.) of vsnprintf() are not
> >>> prepared for it to return a negative value.
> >>>
> >>> The only case where that can currently happen is %pD, and it's IMO
> >>> more user-friendly to produce some output that clearly shows that some
> >>> "impossible" thing happened instead of having the message completely
> >>> ignored - or mishandled as for example log.c would currently do.
> >>>
> >>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
> >>> ---
> >>>  lib/vsprintf.c | 10 +---------
> >>>  1 file changed, 1 insertion(+), 9 deletions(-)
> >>
> >> I think that is debatable. If we want the calling code to be fixed,
> >> then it needs to get an error code back. Otherwise the error will be
> >> apparent to the user but (perhaps) not ever debugged.
> >
> > But it is not the calling code that is at fault for the vsnprintf()
> > implementation (1) being able to fail and (2) actually encountering an
> > ENOMEM situation. There's _nothing_ the calling code can do about that.
> 
> include/vsnprintf.h states:
> 
> "This function follows C99 vsnprintf, but has some extensions:".
> 
> The C99 spec says:
> 
> "The vsnprintf function returns the number of characters that would have
> been written had n been sufficiently large, not counting  the
> terminating  null  character, or a negative value if an encoding error
> occurred."
> 
> It is obvious that the calling code needs to be fixed if it cannot
> handle negative return values.
> 
> So NAK to the patch.
> 
> Best regards
> 
> Heinrich
> 
> >
> > The calling code can be said to be responsible for not passing NULL
> > pointers, but that case is actually handled gracefully in various places
> > in the printf code (both for %pD, but also plain %s).
> >
> >> The definition of printf() allows for the possibility of a negative
> >> return value.
> >
> > First, please distinguish printf() from vsnprintf(). The former (in the
> > normal userspace version) obviously can fail for the obvious EIO, ENOSPC
> > reasons. The latter is indeed allowed to fail per the posix spec, but
> > from a QoI perspective, I'd say it's much better to have a guarantee
> > _for our particular implementation_ that it does not fail (meaning:
> > returns a negative result). There's simply too many direct and indirect
> > users of vsnprintf() that assume the result is non-negative; if we do
> > not provide that guarantee, the alternative is to play a whack-a-mole
> > game and add tons of error-checking code (adding bloat to the image),
> > with almost never any good way to handle it.
> >
> > Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so
> > that it ignores the message if vsnprintf (or vscnprintf, whatever)
> > returns a negative result, just as print() currently does [which is the
> > other thing that log_info could end up being handled by]. That means
> > nothing gets printed on the console, and nobody gets told about the
> > ENOMEM. In contrast, with this patch, we get
> >
> >   Booting <%pD:ENOMEM>
> >
> > printed on the console, so at least _some_ part of the message gets out,
> > and it's apparent that something odd happened. Of course, all of that is
> > in the entirely unlikely sitation where the (efi) allocation would
> > actually fail.
> >
> > If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should
> > ensure vsnprintf returns non-negative; e.g. by changing the "return
> > PTR_ERR()" to a "goto out", i.e. simply stop the processing of the
> > format string at the %pD which failed, but still go through the epilogue
> > that ensures the resulting string becomes nul-terminated (another
> > reasonable assumption made by tons of callers), and return how much got
> > printed till then.

So, how can we fix the callers without the above noted problems?

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 4/5] lib/vsprintf.c: remove unused ip6_addr_string()
  2021-05-20 10:05 ` [PATCH 4/5] lib/vsprintf.c: remove unused ip6_addr_string() Rasmus Villemoes
  2021-05-20 17:51   ` Simon Glass
@ 2021-05-21 14:32   ` Heinrich Schuchardt
  1 sibling, 0 replies; 22+ messages in thread
From: Heinrich Schuchardt @ 2021-05-21 14:32 UTC (permalink / raw)
  To: Rasmus Villemoes, u-boot; +Cc: Simon Glass, Tom Rini

On 20.05.21 12:05, Rasmus Villemoes wrote:
> There's currently no user of %p[iI]6, so including ip6_addr_string()
> in the image is a waste of bytes. It's easy enough to have the
> compiler elide it without removing the code completely.
>
> The closest I can find to anybody "handling" ipv6 in U-Boot currently
> is in efi_net.c which does
>
>         if (ipv6) {
>                 ret = EFI_UNSUPPORTED;
>
> As indicated in the comment, it can easily be put back, but preferably
> under a config knob.
>
> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
> ---
>  lib/vsprintf.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index 65d985982d..6742b0985a 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -434,6 +434,9 @@ static char *uuid_string(char *buf, char *end, u8 *addr, int field_width,
>   * - 'i' [46] for 'raw' IPv4/IPv6 addresses, IPv6 omits the colons, IPv4 is
>   *       currently the same
>   *
> + * Note: IPv6 support is currently if(0)'ed out. If you ever need
> + * %pI6, please add an IPV6 Kconfig knob, make your code select or
> + * depend on that, and change the 0 below to CONFIG_IS_ENABLED(IPV6).
>   */
>  static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
>  		int field_width, int precision, int flags)
> @@ -478,7 +481,7 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
>  		flags |= SPECIAL;
>  		/* Fallthrough */
>  	case 'I':
> -		if (fmt[1] == '6')

Please, provide a commment like "%pI6 currently unused" here.

Best regards

Heinrich

> +		if (0 && fmt[1] == '6')
>  			return ip6_addr_string(buf, end, ptr, field_width,
>  					       precision, flags);
>  		if (fmt[1] == '4')
>


^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-21 14:15       ` Heinrich Schuchardt
  2021-05-21 14:27         ` Tom Rini
@ 2021-05-21 14:40         ` Rasmus Villemoes
  2021-05-21 15:43           ` Heinrich Schuchardt
  2021-05-21 14:48         ` Sean Anderson
  2 siblings, 1 reply; 22+ messages in thread
From: Rasmus Villemoes @ 2021-05-21 14:40 UTC (permalink / raw)
  To: Heinrich Schuchardt; +Cc: U-Boot Mailing List, Tom Rini, Simon Glass

On 21/05/2021 16.15, Heinrich Schuchardt wrote:
> On 21.05.21 14:53, Rasmus Villemoes wrote:
>> On 20/05/2021 19.51, Simon Glass wrote:
>>> Hi Rasmus,
>>>
>>> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
>>> <rasmus.villemoes@prevas.dk> wrote:
>>>>
>>>> Most callers (or callers of callers, etc.) of vsnprintf() are not
>>>> prepared for it to return a negative value.
>>>>
>>>> The only case where that can currently happen is %pD, and it's IMO
>>>> more user-friendly to produce some output that clearly shows that some
>>>> "impossible" thing happened instead of having the message completely
>>>> ignored - or mishandled as for example log.c would currently do.
>>>>
>>>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
>>>> ---
>>>>  lib/vsprintf.c | 10 +---------
>>>>  1 file changed, 1 insertion(+), 9 deletions(-)
>>>
>>> I think that is debatable. If we want the calling code to be fixed,
>>> then it needs to get an error code back. Otherwise the error will be
>>> apparent to the user but (perhaps) not ever debugged.
>>
>> But it is not the calling code that is at fault for the vsnprintf()
>> implementation (1) being able to fail and (2) actually encountering an
>> ENOMEM situation. There's _nothing_ the calling code can do about that.
> 
> include/vsnprintf.h states:
> 
> "This function follows C99 vsnprintf, but has some extensions:".

Happy to update that comment (which is copied from linux BTW, and in the
kernel there's a very simple rule: "This is printk. We want it to work."
- that extends to the workhorse vsnprintf() which is not allowed to take
locks or do allocations) with an amendment "... among which is that it
never returns a negative value."

> It is obvious that the calling code needs to be fixed if it cannot
> handle negative return values.
> 
> So NAK to the patch.

So you'd rather fix the ~200 places that use the return value assuming
it's non-negative, plus the unknown number of places that assume the
output buffer is a valid nul-terminated string after vsnprintf() returns?

And, again taking that %pD example, do you really rather want _nothing_
printed (which is the only thing log.c could sensibly do if vsnprintf()
returned something negative) in the rare case of allocation failure?

I must admit I completely fail to see how this can possibly be better
than improving the guarantees provided by U-Boot's vsnprintf()
implementation.

Rasmus

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-21 14:27         ` Tom Rini
@ 2021-05-21 14:42           ` Heinrich Schuchardt
  2021-05-27 23:01             ` Rasmus Villemoes
  0 siblings, 1 reply; 22+ messages in thread
From: Heinrich Schuchardt @ 2021-05-21 14:42 UTC (permalink / raw)
  To: Tom Rini; +Cc: Rasmus Villemoes, U-Boot Mailing List, Simon Glass

On 21.05.21 16:27, Tom Rini wrote:
> On Fri, May 21, 2021 at 04:15:39PM +0200, Heinrich Schuchardt wrote:
>> On 21.05.21 14:53, Rasmus Villemoes wrote:
>>> On 20/05/2021 19.51, Simon Glass wrote:
>>>> Hi Rasmus,
>>>>
>>>> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
>>>> <rasmus.villemoes@prevas.dk> wrote:
>>>>>
>>>>> Most callers (or callers of callers, etc.) of vsnprintf() are not
>>>>> prepared for it to return a negative value.
>>>>>
>>>>> The only case where that can currently happen is %pD, and it's IMO
>>>>> more user-friendly to produce some output that clearly shows that some
>>>>> "impossible" thing happened instead of having the message completely
>>>>> ignored - or mishandled as for example log.c would currently do.
>>>>>
>>>>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
>>>>> ---
>>>>>  lib/vsprintf.c | 10 +---------
>>>>>  1 file changed, 1 insertion(+), 9 deletions(-)
>>>>
>>>> I think that is debatable. If we want the calling code to be fixed,
>>>> then it needs to get an error code back. Otherwise the error will be
>>>> apparent to the user but (perhaps) not ever debugged.
>>>
>>> But it is not the calling code that is at fault for the vsnprintf()
>>> implementation (1) being able to fail and (2) actually encountering an
>>> ENOMEM situation. There's _nothing_ the calling code can do about that.
>>
>> include/vsnprintf.h states:
>>
>> "This function follows C99 vsnprintf, but has some extensions:".
>>
>> The C99 spec says:
>>
>> "The vsnprintf function returns the number of characters that would have
>> been written had n been sufficiently large, not counting  the
>> terminating  null  character, or a negative value if an encoding error
>> occurred."
>>
>> It is obvious that the calling code needs to be fixed if it cannot
>> handle negative return values.
>>
>> So NAK to the patch.
>>
>> Best regards
>>
>> Heinrich
>>
>>>
>>> The calling code can be said to be responsible for not passing NULL
>>> pointers, but that case is actually handled gracefully in various places
>>> in the printf code (both for %pD, but also plain %s).
>>>
>>>> The definition of printf() allows for the possibility of a negative
>>>> return value.
>>>
>>> First, please distinguish printf() from vsnprintf(). The former (in the
>>> normal userspace version) obviously can fail for the obvious EIO, ENOSPC
>>> reasons. The latter is indeed allowed to fail per the posix spec, but
>>> from a QoI perspective, I'd say it's much better to have a guarantee
>>> _for our particular implementation_ that it does not fail (meaning:
>>> returns a negative result). There's simply too many direct and indirect
>>> users of vsnprintf() that assume the result is non-negative; if we do
>>> not provide that guarantee, the alternative is to play a whack-a-mole
>>> game and add tons of error-checking code (adding bloat to the image),
>>> with almost never any good way to handle it.
>>>
>>> Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so
>>> that it ignores the message if vsnprintf (or vscnprintf, whatever)
>>> returns a negative result, just as print() currently does [which is the
>>> other thing that log_info could end up being handled by]. That means
>>> nothing gets printed on the console, and nobody gets told about the
>>> ENOMEM. In contrast, with this patch, we get
>>>
>>>   Booting <%pD:ENOMEM>
>>>
>>> printed on the console, so at least _some_ part of the message gets out,
>>> and it's apparent that something odd happened. Of course, all of that is
>>> in the entirely unlikely sitation where the (efi) allocation would
>>> actually fail.
>>>
>>> If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should
>>> ensure vsnprintf returns non-negative; e.g. by changing the "return
>>> PTR_ERR()" to a "goto out", i.e. simply stop the processing of the
>>> format string at the %pD which failed, but still go through the epilogue
>>> that ensures the resulting string becomes nul-terminated (another
>>> reasonable assumption made by tons of callers), and return how much got
>>> printed till then.
>
> So, how can we fix the callers without the above noted problems?
>

The assumption that vsnprintf() is used to print to the console and that
writing some arbitrary string to the buffer is allowable is utterly wrong.

vsnprintf_internal() is used to implement snprintf(). snprintf() is used
in numerous places where it will not lead to console output.

Trying to solve one problem this patch creates a bunch of new ones.

Best regards

Heinrich

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-21 14:15       ` Heinrich Schuchardt
  2021-05-21 14:27         ` Tom Rini
  2021-05-21 14:40         ` Rasmus Villemoes
@ 2021-05-21 14:48         ` Sean Anderson
  2 siblings, 0 replies; 22+ messages in thread
From: Sean Anderson @ 2021-05-21 14:48 UTC (permalink / raw)
  To: Heinrich Schuchardt, Rasmus Villemoes
  Cc: U-Boot Mailing List, Tom Rini, Simon Glass



On 5/21/21 10:15 AM, Heinrich Schuchardt wrote:
 > On 21.05.21 14:53, Rasmus Villemoes wrote:
 >> On 20/05/2021 19.51, Simon Glass wrote:
 >>> Hi Rasmus,
 >>>
 >>> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
 >>> <rasmus.villemoes@prevas.dk> wrote:
 >>>>
 >>>> Most callers (or callers of callers, etc.) of vsnprintf() are not
 >>>> prepared for it to return a negative value.
 >>>>
 >>>> The only case where that can currently happen is %pD, and it's IMO
 >>>> more user-friendly to produce some output that clearly shows that some
 >>>> "impossible" thing happened instead of having the message completely
 >>>> ignored - or mishandled as for example log.c would currently do.
 >>>>
 >>>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
 >>>> ---
 >>>>   lib/vsprintf.c | 10 +---------
 >>>>   1 file changed, 1 insertion(+), 9 deletions(-)
 >>>
 >>> I think that is debatable. If we want the calling code to be fixed,
 >>> then it needs to get an error code back. Otherwise the error will be
 >>> apparent to the user but (perhaps) not ever debugged.
 >>
 >> But it is not the calling code that is at fault for the vsnprintf()
 >> implementation (1) being able to fail and (2) actually encountering an
 >> ENOMEM situation. There's _nothing_ the calling code can do about that.
 >
 > include/vsnprintf.h states:
 >
 > "This function follows C99 vsnprintf, but has some extensions:".
 >
 > The C99 spec says:
 >
 > "The vsnprintf function returns the number of characters that would have
 > been written had n been sufficiently large, not counting  the
 > terminating  null  character, or a negative value if an encoding error
 > occurred."

But is this an encoding error? And of course, the most common use of
this function which checks this return value will be

	n = vsnprintf(NULL, 0, fmt, ...);
	buf = malloc(n);
	if (!buf)
		/* out of memory */
	vsnprintf(buf, n, fmt, ...);

Which effectively already checks for ENOMEM. While it is
standard-compliant to return negative, it is also compliant to just use
a bogus value or to write nothing. There are many callers of
[v]s[c]nprintf which use the same pattern as the code above. If you
would like to fix all of them, go ahead. But I think this fix is more
efficient a cut.

--Sean

 >
 > It is obvious that the calling code needs to be fixed if it cannot
 > handle negative return values.
 >
 > So NAK to the patch.
 >
 > Best regards
 >
 > Heinrich
 >
 >>
 >> The calling code can be said to be responsible for not passing NULL
 >> pointers, but that case is actually handled gracefully in various places
 >> in the printf code (both for %pD, but also plain %s).
 >>
 >>> The definition of printf() allows for the possibility of a negative
 >>> return value.
 >>
 >> First, please distinguish printf() from vsnprintf(). The former (in the
 >> normal userspace version) obviously can fail for the obvious EIO, ENOSPC
 >> reasons. The latter is indeed allowed to fail per the posix spec, but
 >> from a QoI perspective, I'd say it's much better to have a guarantee
 >> _for our particular implementation_ that it does not fail (meaning:
 >> returns a negative result). There's simply too many direct and indirect
 >> users of vsnprintf() that assume the result is non-negative; if we do
 >> not provide that guarantee, the alternative is to play a whack-a-mole
 >> game and add tons of error-checking code (adding bloat to the image),
 >> with almost never any good way to handle it.
 >>
 >> Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so
 >> that it ignores the message if vsnprintf (or vscnprintf, whatever)
 >> returns a negative result, just as print() currently does [which is the
 >> other thing that log_info could end up being handled by]. That means
 >> nothing gets printed on the console, and nobody gets told about the
 >> ENOMEM. In contrast, with this patch, we get
 >>
 >>    Booting <%pD:ENOMEM>
 >>
 >> printed on the console, so at least _some_ part of the message gets out,
 >> and it's apparent that something odd happened. Of course, all of that is
 >> in the entirely unlikely sitation where the (efi) allocation would
 >> actually fail.
 >>
 >> If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should
 >> ensure vsnprintf returns non-negative; e.g. by changing the "return
 >> PTR_ERR()" to a "goto out", i.e. simply stop the processing of the
 >> format string at the %pD which failed, but still go through the epilogue
 >> that ensures the resulting string becomes nul-terminated (another
 >> reasonable assumption made by tons of callers), and return how much got
 >> printed till then.
 >>
 >> Rasmus
 >>
 >

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-21 14:40         ` Rasmus Villemoes
@ 2021-05-21 15:43           ` Heinrich Schuchardt
  0 siblings, 0 replies; 22+ messages in thread
From: Heinrich Schuchardt @ 2021-05-21 15:43 UTC (permalink / raw)
  To: Rasmus Villemoes; +Cc: U-Boot Mailing List, Tom Rini, Simon Glass

On 21.05.21 16:40, Rasmus Villemoes wrote:
> On 21/05/2021 16.15, Heinrich Schuchardt wrote:
>> On 21.05.21 14:53, Rasmus Villemoes wrote:
>>> On 20/05/2021 19.51, Simon Glass wrote:
>>>> Hi Rasmus,
>>>>
>>>> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
>>>> <rasmus.villemoes@prevas.dk> wrote:
>>>>>
>>>>> Most callers (or callers of callers, etc.) of vsnprintf() are not
>>>>> prepared for it to return a negative value.
>>>>>
>>>>> The only case where that can currently happen is %pD, and it's IMO
>>>>> more user-friendly to produce some output that clearly shows that some
>>>>> "impossible" thing happened instead of having the message completely
>>>>> ignored - or mishandled as for example log.c would currently do.
>>>>>
>>>>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
>>>>> ---
>>>>>  lib/vsprintf.c | 10 +---------
>>>>>  1 file changed, 1 insertion(+), 9 deletions(-)
>>>>
>>>> I think that is debatable. If we want the calling code to be fixed,
>>>> then it needs to get an error code back. Otherwise the error will be
>>>> apparent to the user but (perhaps) not ever debugged.
>>>
>>> But it is not the calling code that is at fault for the vsnprintf()
>>> implementation (1) being able to fail and (2) actually encountering an
>>> ENOMEM situation. There's _nothing_ the calling code can do about that.
>>
>> include/vsnprintf.h states:
>>
>> "This function follows C99 vsnprintf, but has some extensions:".
>
> Happy to update that comment (which is copied from linux BTW, and in the
> kernel there's a very simple rule: "This is printk. We want it to work."
> - that extends to the workhorse vsnprintf() which is not allowed to take
> locks or do allocations) with an amendment "... among which is that it
> never returns a negative value."
>
>> It is obvious that the calling code needs to be fixed if it cannot
>> handle negative return values.
>>
>> So NAK to the patch.
>
> So you'd rather fix the ~200 places that use the return value assuming
> it's non-negative,

As you pointed out in patch 5 any usage of (v)snprintf assuming that the
return value is the number of characters copied to the buffer has to be
corrected anyways.

plus the unknown number of places that assume the
> output buffer is a valid nul-terminated string after vsnprintf() returns?

Ensuring that the buffer is always nul-terminated would not contradict
the C99 specification.

Best regards

Heinrich

>
> And, again taking that %pD example, do you really rather want _nothing_
> printed (which is the only thing log.c could sensibly do if vsnprintf()
> returned something negative) in the rare case of allocation failure?
>
> I must admit I completely fail to see how this can possibly be better
> than improving the guarantees provided by U-Boot's vsnprintf()
> implementation.
>
> Rasmus
>


^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-21 14:42           ` Heinrich Schuchardt
@ 2021-05-27 23:01             ` Rasmus Villemoes
  2021-06-19 17:32               ` Simon Glass
  0 siblings, 1 reply; 22+ messages in thread
From: Rasmus Villemoes @ 2021-05-27 23:01 UTC (permalink / raw)
  To: Heinrich Schuchardt, Tom Rini; +Cc: U-Boot Mailing List, Simon Glass

On 21/05/2021 16.42, Heinrich Schuchardt wrote:
> On 21.05.21 16:27, Tom Rini wrote:
>> On Fri, May 21, 2021 at 04:15:39PM +0200, Heinrich Schuchardt wrote:
>>> On 21.05.21 14:53, Rasmus Villemoes wrote:
>>>> On 20/05/2021 19.51, Simon Glass wrote:
>>>>> Hi Rasmus,
>>>>>
>>>>> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
>>>>> <rasmus.villemoes@prevas.dk> wrote:
>>>>>>
>>>>>> Most callers (or callers of callers, etc.) of vsnprintf() are not
>>>>>> prepared for it to return a negative value.
>>>>>>
>>>>>> The only case where that can currently happen is %pD, and it's IMO
>>>>>> more user-friendly to produce some output that clearly shows that some
>>>>>> "impossible" thing happened instead of having the message completely
>>>>>> ignored - or mishandled as for example log.c would currently do.
>>>>>>
>>>>>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
>>>>>> ---
>>>>>>  lib/vsprintf.c | 10 +---------
>>>>>>  1 file changed, 1 insertion(+), 9 deletions(-)
>>>>>
>>>>> I think that is debatable. If we want the calling code to be fixed,
>>>>> then it needs to get an error code back. Otherwise the error will be
>>>>> apparent to the user but (perhaps) not ever debugged.
>>>>
>>>> But it is not the calling code that is at fault for the vsnprintf()
>>>> implementation (1) being able to fail and (2) actually encountering an
>>>> ENOMEM situation. There's _nothing_ the calling code can do about that.
>>>
>>> include/vsnprintf.h states:
>>>
>>> "This function follows C99 vsnprintf, but has some extensions:".
>>>
>>> The C99 spec says:
>>>
>>> "The vsnprintf function returns the number of characters that would have
>>> been written had n been sufficiently large, not counting  the
>>> terminating  null  character, or a negative value if an encoding error
>>> occurred."
>>>
>>> It is obvious that the calling code needs to be fixed if it cannot
>>> handle negative return values.
>>>
>>> So NAK to the patch.
>>>
>>> Best regards
>>>
>>> Heinrich
>>>
>>>>
>>>> The calling code can be said to be responsible for not passing NULL
>>>> pointers, but that case is actually handled gracefully in various places
>>>> in the printf code (both for %pD, but also plain %s).
>>>>
>>>>> The definition of printf() allows for the possibility of a negative
>>>>> return value.
>>>>
>>>> First, please distinguish printf() from vsnprintf(). The former (in the
>>>> normal userspace version) obviously can fail for the obvious EIO, ENOSPC
>>>> reasons. The latter is indeed allowed to fail per the posix spec, but
>>>> from a QoI perspective, I'd say it's much better to have a guarantee
>>>> _for our particular implementation_ that it does not fail (meaning:
>>>> returns a negative result). There's simply too many direct and indirect
>>>> users of vsnprintf() that assume the result is non-negative; if we do
>>>> not provide that guarantee, the alternative is to play a whack-a-mole
>>>> game and add tons of error-checking code (adding bloat to the image),
>>>> with almost never any good way to handle it.
>>>>
>>>> Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so
>>>> that it ignores the message if vsnprintf (or vscnprintf, whatever)
>>>> returns a negative result, just as print() currently does [which is the
>>>> other thing that log_info could end up being handled by]. That means
>>>> nothing gets printed on the console, and nobody gets told about the
>>>> ENOMEM. In contrast, with this patch, we get
>>>>
>>>>   Booting <%pD:ENOMEM>
>>>>
>>>> printed on the console, so at least _some_ part of the message gets out,
>>>> and it's apparent that something odd happened. Of course, all of that is
>>>> in the entirely unlikely sitation where the (efi) allocation would
>>>> actually fail.
>>>>
>>>> If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should
>>>> ensure vsnprintf returns non-negative; e.g. by changing the "return
>>>> PTR_ERR()" to a "goto out", i.e. simply stop the processing of the
>>>> format string at the %pD which failed, but still go through the epilogue
>>>> that ensures the resulting string becomes nul-terminated (another
>>>> reasonable assumption made by tons of callers), and return how much got
>>>> printed till then.
>>
>> So, how can we fix the callers without the above noted problems?
>>
> 
> The assumption that vsnprintf() is used to print to the console and that
> writing some arbitrary string to the buffer is allowable is utterly wrong.
> 
> vsnprintf_internal() is used to implement snprintf(). snprintf() is used
> in numerous places where it will not lead to console output.
> 
> Trying to solve one problem this patch creates a bunch of new ones.

Heinrich, you do realize that the error handling you added in 256060e
when you made it possible for vsnprintf() to return something negative
is broken and incomplete? In multiple ways, even.

First, let's look at vscnprint, which wasn't touched by 256060e.

int vscnprintf(char *buf, size_t size, const char *fmt, va_list args)
{
        int i;

        i = vsnprintf(buf, size, fmt, args);

        if (likely(i < size))
                return i;

Integer promotion says that, should i be -ENOMEM or some other random
-Esomething, that comparison is false (for any realistic value of the
size parameter), so we won't actually pass on that negative value.
Instead, we'll fall through to the logic that handles "oh, vsnprintf()
didn't have enough room, so the length of the generated string, which is
what I'm supposed to return, is size-1".

Hence printf(), which uses vscnprintf(), would in that case receive
CONFIG_SYS_PBSIZE-1 as result, and then it would go on to puts() the
printbuffer[] - which isn't a nul-terminated string because you did that
early return, so it has stack garbage.

Let us look at printf() in more detail. Assuming vscnprintf() forwarded
a negative value directly, do you see the problem here:

        uint i;
	
        i = vscnprintf(printbuffer, sizeof(printbuffer), fmt, args);

        /* Handle error */
        if (i <= 0)
                return i;

So even if vscnprintf() was updated, printf() _still_ would go on to
pass stack garbage to puts().

====

Let me re-iterate what I believe any vsnprintf-implementation (and its
close wrappers [v]s[c][n]printf) in a kernel or bootloader context must
satisfy:

- never return a negative value
- given a non-zero size argument, must guarantee that the output buffer
is a proper nul-terminated string.

Without those guarantees, bugs like those described above will creep in,
even if somebody fixes the issues I just pointed out. I'm not gonna send
band-aid patches which will just propagate the problems to all other users.

Not only do these guarantees make it easier to use the sprintf family,
it also avoids lots of code bloat from unnecessary 'ret < 0' checks. It
really has nothing to do with whether the output is destined for the
console, _all_ users (direct or through several layers of helpers) of
the sprintf family benefit from an implementation that provides these
guarantees.

Rasmus

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
  2021-05-27 23:01             ` Rasmus Villemoes
@ 2021-06-19 17:32               ` Simon Glass
  0 siblings, 0 replies; 22+ messages in thread
From: Simon Glass @ 2021-06-19 17:32 UTC (permalink / raw)
  To: Rasmus Villemoes; +Cc: Heinrich Schuchardt, Tom Rini, U-Boot Mailing List

Hi Rasmus,

On Thu, 27 May 2021 at 17:01, Rasmus Villemoes
<rasmus.villemoes@prevas.dk> wrote:
>
> On 21/05/2021 16.42, Heinrich Schuchardt wrote:
> > On 21.05.21 16:27, Tom Rini wrote:
> >> On Fri, May 21, 2021 at 04:15:39PM +0200, Heinrich Schuchardt wrote:
> >>> On 21.05.21 14:53, Rasmus Villemoes wrote:
> >>>> On 20/05/2021 19.51, Simon Glass wrote:
> >>>>> Hi Rasmus,
> >>>>>
> >>>>> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
> >>>>> <rasmus.villemoes@prevas.dk> wrote:
> >>>>>>
> >>>>>> Most callers (or callers of callers, etc.) of vsnprintf() are not
> >>>>>> prepared for it to return a negative value.
> >>>>>>
> >>>>>> The only case where that can currently happen is %pD, and it's IMO
> >>>>>> more user-friendly to produce some output that clearly shows that some
> >>>>>> "impossible" thing happened instead of having the message completely
> >>>>>> ignored - or mishandled as for example log.c would currently do.
> >>>>>>
> >>>>>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
> >>>>>> ---
> >>>>>>  lib/vsprintf.c | 10 +---------
> >>>>>>  1 file changed, 1 insertion(+), 9 deletions(-)
> >>>>>
> >>>>> I think that is debatable. If we want the calling code to be fixed,
> >>>>> then it needs to get an error code back. Otherwise the error will be
> >>>>> apparent to the user but (perhaps) not ever debugged.
> >>>>
> >>>> But it is not the calling code that is at fault for the vsnprintf()
> >>>> implementation (1) being able to fail and (2) actually encountering an
> >>>> ENOMEM situation. There's _nothing_ the calling code can do about that.
> >>>
> >>> include/vsnprintf.h states:
> >>>
> >>> "This function follows C99 vsnprintf, but has some extensions:".
> >>>
> >>> The C99 spec says:
> >>>
> >>> "The vsnprintf function returns the number of characters that would have
> >>> been written had n been sufficiently large, not counting  the
> >>> terminating  null  character, or a negative value if an encoding error
> >>> occurred."
> >>>
> >>> It is obvious that the calling code needs to be fixed if it cannot
> >>> handle negative return values.
> >>>
> >>> So NAK to the patch.
> >>>
> >>> Best regards
> >>>
> >>> Heinrich
> >>>
> >>>>
> >>>> The calling code can be said to be responsible for not passing NULL
> >>>> pointers, but that case is actually handled gracefully in various places
> >>>> in the printf code (both for %pD, but also plain %s).
> >>>>
> >>>>> The definition of printf() allows for the possibility of a negative
> >>>>> return value.
> >>>>
> >>>> First, please distinguish printf() from vsnprintf(). The former (in the
> >>>> normal userspace version) obviously can fail for the obvious EIO, ENOSPC
> >>>> reasons. The latter is indeed allowed to fail per the posix spec, but
> >>>> from a QoI perspective, I'd say it's much better to have a guarantee
> >>>> _for our particular implementation_ that it does not fail (meaning:
> >>>> returns a negative result). There's simply too many direct and indirect
> >>>> users of vsnprintf() that assume the result is non-negative; if we do
> >>>> not provide that guarantee, the alternative is to play a whack-a-mole
> >>>> game and add tons of error-checking code (adding bloat to the image),
> >>>> with almost never any good way to handle it.
> >>>>
> >>>> Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so
> >>>> that it ignores the message if vsnprintf (or vscnprintf, whatever)
> >>>> returns a negative result, just as print() currently does [which is the
> >>>> other thing that log_info could end up being handled by]. That means
> >>>> nothing gets printed on the console, and nobody gets told about the
> >>>> ENOMEM. In contrast, with this patch, we get
> >>>>
> >>>>   Booting <%pD:ENOMEM>
> >>>>
> >>>> printed on the console, so at least _some_ part of the message gets out,
> >>>> and it's apparent that something odd happened. Of course, all of that is
> >>>> in the entirely unlikely sitation where the (efi) allocation would
> >>>> actually fail.
> >>>>
> >>>> If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should
> >>>> ensure vsnprintf returns non-negative; e.g. by changing the "return
> >>>> PTR_ERR()" to a "goto out", i.e. simply stop the processing of the
> >>>> format string at the %pD which failed, but still go through the epilogue
> >>>> that ensures the resulting string becomes nul-terminated (another
> >>>> reasonable assumption made by tons of callers), and return how much got
> >>>> printed till then.
> >>
> >> So, how can we fix the callers without the above noted problems?
> >>
> >
> > The assumption that vsnprintf() is used to print to the console and that
> > writing some arbitrary string to the buffer is allowable is utterly wrong.
> >
> > vsnprintf_internal() is used to implement snprintf(). snprintf() is used
> > in numerous places where it will not lead to console output.
> >
> > Trying to solve one problem this patch creates a bunch of new ones.
>
> Heinrich, you do realize that the error handling you added in 256060e
> when you made it possible for vsnprintf() to return something negative
> is broken and incomplete? In multiple ways, even.
>
> First, let's look at vscnprint, which wasn't touched by 256060e.
>
> int vscnprintf(char *buf, size_t size, const char *fmt, va_list args)
> {
>         int i;
>
>         i = vsnprintf(buf, size, fmt, args);
>
>         if (likely(i < size))
>                 return i;
>
> Integer promotion says that, should i be -ENOMEM or some other random
> -Esomething, that comparison is false (for any realistic value of the
> size parameter), so we won't actually pass on that negative value.
> Instead, we'll fall through to the logic that handles "oh, vsnprintf()
> didn't have enough room, so the length of the generated string, which is
> what I'm supposed to return, is size-1".
>
> Hence printf(), which uses vscnprintf(), would in that case receive
> CONFIG_SYS_PBSIZE-1 as result, and then it would go on to puts() the
> printbuffer[] - which isn't a nul-terminated string because you did that
> early return, so it has stack garbage.
>
> Let us look at printf() in more detail. Assuming vscnprintf() forwarded
> a negative value directly, do you see the problem here:
>
>         uint i;
>
>         i = vscnprintf(printbuffer, sizeof(printbuffer), fmt, args);
>
>         /* Handle error */
>         if (i <= 0)
>                 return i;
>
> So even if vscnprintf() was updated, printf() _still_ would go on to
> pass stack garbage to puts().
>
> ====
>
> Let me re-iterate what I believe any vsnprintf-implementation (and its
> close wrappers [v]s[c][n]printf) in a kernel or bootloader context must
> satisfy:
>
> - never return a negative value
> - given a non-zero size argument, must guarantee that the output buffer
> is a proper nul-terminated string.
>
> Without those guarantees, bugs like those described above will creep in,
> even if somebody fixes the issues I just pointed out. I'm not gonna send
> band-aid patches which will just propagate the problems to all other users.
>
> Not only do these guarantees make it easier to use the sprintf family,
> it also avoids lots of code bloat from unnecessary 'ret < 0' checks. It
> really has nothing to do with whether the output is destined for the
> console, _all_ users (direct or through several layers of helpers) of
> the sprintf family benefit from an implementation that provides these
> guarantees.

Gosh what a lot of stuff to read. Thank you both for all the analysis.
I feel that s...printf() should never return an error code, so I agree
with Rasmus, I suppose.

EFI's oddity here is just going to have to be EFI's problem. I am not
becoming more sympathetic to the EFI-ification of firmware, nor does
this sort of corner case progress the cause

If we need to return an error somehow, then I suggest:

- create a new function, e.g. vsprintf_err()
- carry around a flag in vsprintf.c to indicate the behaviour on error
- put support for the flag behind a CONFIG to avoid code-size bloat

Reviewed-by: Simon Glass <sjg@chromium.org>

(but please update docs for pointer() to explain args and return value)

Regards,
Simon

^ permalink raw reply	[flat|nested] 22+ messages in thread

end of thread, other threads:[~2021-06-19 17:32 UTC | newest]

Thread overview: 22+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-20 10:05 [PATCH 0/5] assorted printf-related patches Rasmus Villemoes
2021-05-20 10:05 ` [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass
2021-05-21 12:53     ` Rasmus Villemoes
2021-05-21 14:15       ` Heinrich Schuchardt
2021-05-21 14:27         ` Tom Rini
2021-05-21 14:42           ` Heinrich Schuchardt
2021-05-27 23:01             ` Rasmus Villemoes
2021-06-19 17:32               ` Simon Glass
2021-05-21 14:40         ` Rasmus Villemoes
2021-05-21 15:43           ` Heinrich Schuchardt
2021-05-21 14:48         ` Sean Anderson
2021-05-20 10:05 ` [PATCH 2/5] lib/vsprintf.c: implement printf() in terms of vprintf() Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass
2021-05-20 10:05 ` [PATCH 3/5] lib/vsprintf.c: remove stale comment Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass
2021-05-21 14:22   ` Heinrich Schuchardt
2021-05-20 10:05 ` [PATCH 4/5] lib/vsprintf.c: remove unused ip6_addr_string() Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass
2021-05-21 14:32   ` Heinrich Schuchardt
2021-05-20 10:05 ` [PATCH 5/5] common/log.c: use vscnprintf() in log_dispatch() Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.