All of lore.kernel.org
 help / color / mirror / Atom feed
From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
To: Simon Glass <sjg@chromium.org>
Cc: U-Boot Mailing List <u-boot@lists.denx.de>,
	Heinrich Schuchardt <xypron.glpk@gmx.de>,
	Tom Rini <trini@konsulko.com>
Subject: Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value
Date: Fri, 21 May 2021 14:53:48 +0200	[thread overview]
Message-ID: <e5b8532c-7d5b-d3cd-ddfa-5da697871ffc@prevas.dk> (raw)
In-Reply-To: <CAPnjgZ2T6XPpBENCLCpsuZaZuFqnrxgWUV_=fnx64Y+4gQK4og@mail.gmail.com>

On 20/05/2021 19.51, Simon Glass wrote:
> Hi Rasmus,
> 
> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
> <rasmus.villemoes@prevas.dk> wrote:
>>
>> Most callers (or callers of callers, etc.) of vsnprintf() are not
>> prepared for it to return a negative value.
>>
>> The only case where that can currently happen is %pD, and it's IMO
>> more user-friendly to produce some output that clearly shows that some
>> "impossible" thing happened instead of having the message completely
>> ignored - or mishandled as for example log.c would currently do.
>>
>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
>> ---
>>  lib/vsprintf.c | 10 +---------
>>  1 file changed, 1 insertion(+), 9 deletions(-)
> 
> I think that is debatable. If we want the calling code to be fixed,
> then it needs to get an error code back. Otherwise the error will be
> apparent to the user but (perhaps) not ever debugged.

But it is not the calling code that is at fault for the vsnprintf()
implementation (1) being able to fail and (2) actually encountering an
ENOMEM situation. There's _nothing_ the calling code can do about that.

The calling code can be said to be responsible for not passing NULL
pointers, but that case is actually handled gracefully in various places
in the printf code (both for %pD, but also plain %s).

> The definition of printf() allows for the possibility of a negative
> return value.

First, please distinguish printf() from vsnprintf(). The former (in the
normal userspace version) obviously can fail for the obvious EIO, ENOSPC
reasons. The latter is indeed allowed to fail per the posix spec, but
from a QoI perspective, I'd say it's much better to have a guarantee
_for our particular implementation_ that it does not fail (meaning:
returns a negative result). There's simply too many direct and indirect
users of vsnprintf() that assume the result is non-negative; if we do
not provide that guarantee, the alternative is to play a whack-a-mole
game and add tons of error-checking code (adding bloat to the image),
with almost never any good way to handle it.

Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so
that it ignores the message if vsnprintf (or vscnprintf, whatever)
returns a negative result, just as print() currently does [which is the
other thing that log_info could end up being handled by]. That means
nothing gets printed on the console, and nobody gets told about the
ENOMEM. In contrast, with this patch, we get

  Booting <%pD:ENOMEM>

printed on the console, so at least _some_ part of the message gets out,
and it's apparent that something odd happened. Of course, all of that is
in the entirely unlikely sitation where the (efi) allocation would
actually fail.

If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should
ensure vsnprintf returns non-negative; e.g. by changing the "return
PTR_ERR()" to a "goto out", i.e. simply stop the processing of the
format string at the %pD which failed, but still go through the epilogue
that ensures the resulting string becomes nul-terminated (another
reasonable assumption made by tons of callers), and return how much got
printed till then.

Rasmus

  reply	other threads:[~2021-05-21 12:54 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-20 10:05 [PATCH 0/5] assorted printf-related patches Rasmus Villemoes
2021-05-20 10:05 ` [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass
2021-05-21 12:53     ` Rasmus Villemoes [this message]
2021-05-21 14:15       ` Heinrich Schuchardt
2021-05-21 14:27         ` Tom Rini
2021-05-21 14:42           ` Heinrich Schuchardt
2021-05-27 23:01             ` Rasmus Villemoes
2021-06-19 17:32               ` Simon Glass
2021-05-21 14:40         ` Rasmus Villemoes
2021-05-21 15:43           ` Heinrich Schuchardt
2021-05-21 14:48         ` Sean Anderson
2021-05-20 10:05 ` [PATCH 2/5] lib/vsprintf.c: implement printf() in terms of vprintf() Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass
2021-05-20 10:05 ` [PATCH 3/5] lib/vsprintf.c: remove stale comment Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass
2021-05-21 14:22   ` Heinrich Schuchardt
2021-05-20 10:05 ` [PATCH 4/5] lib/vsprintf.c: remove unused ip6_addr_string() Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass
2021-05-21 14:32   ` Heinrich Schuchardt
2021-05-20 10:05 ` [PATCH 5/5] common/log.c: use vscnprintf() in log_dispatch() Rasmus Villemoes
2021-05-20 17:51   ` Simon Glass

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=e5b8532c-7d5b-d3cd-ddfa-5da697871ffc@prevas.dk \
    --to=rasmus.villemoes@prevas.dk \
    --cc=sjg@chromium.org \
    --cc=trini@konsulko.com \
    --cc=u-boot@lists.denx.de \
    --cc=xypron.glpk@gmx.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.