"size" is size_t. If we want to check whether it was underflowed
then we should cast it to ssize_t instead of int. When
sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
but it is not.
Signed-off-by: Vasiliy Kulikov <[email protected]>
---
Compile tested.
lib/vsprintf.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c150d3d..e7cf674 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1290,7 +1290,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
/* Reject out-of-range values early. Large positive sizes are
used for unknown buffer sizes. */
- if (WARN_ON_ONCE((int) size < 0))
+ if (WARN_ON_ONCE((ssize_t) size < 0))
return 0;
str = buf;
--
1.7.0.4
On Wed, 10 Nov 2010 23:38:08 +0300
Vasiliy Kulikov <[email protected]> wrote:
> "size" is size_t. If we want to check whether it was underflowed
> then we should cast it to ssize_t instead of int. When
> sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> but it is not.
>
Does this patch fix any actual observed problem?
> Compile tested.
>
I guess not.
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -1290,7 +1290,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
>
> /* Reject out-of-range values early. Large positive sizes are
> used for unknown buffer sizes. */
Thousands of people would find that comment to be utterly mysterious.
I am one.
> - if (WARN_ON_ONCE((int) size < 0))
> + if (WARN_ON_ONCE((ssize_t) size < 0))
> return 0;
>
> str = buf;
On Wed, 10 Nov 2010, Andrew Morton wrote:
> > "size" is size_t. If we want to check whether it was underflowed
> > then we should cast it to ssize_t instead of int. When
> > sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> > but it is not.
> >
>
> Does this patch fix any actual observed problem?
>
> > Compile tested.
> >
>
> I guess not.
>
> > --- a/lib/vsprintf.c
> > +++ b/lib/vsprintf.c
> > @@ -1290,7 +1290,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
> >
> > /* Reject out-of-range values early. Large positive sizes are
> > used for unknown buffer sizes. */
>
> Thousands of people would find that comment to be utterly mysterious.
> I am one.
>
vsprintf() and sprintf() pass INT_MAX for an unbounded buffer length, so
the cast to int here in the original code is correct. The type of
interest is not of the passed size, but rather the return value of the
function. The changelog is wrong: if sizeof(size_t) > sizeof(int) then
the return value overflows.
> > - if (WARN_ON_ONCE((int) size < 0))
> > + if (WARN_ON_ONCE((ssize_t) size < 0))
> > return 0;
> >
> > str = buf;
On Wed, Nov 10, 2010 at 13:38 -0800, David Rientjes wrote:
> On Wed, 10 Nov 2010, Andrew Morton wrote:
>
> > > "size" is size_t. If we want to check whether it was underflowed
> > > then we should cast it to ssize_t instead of int. When
> > > sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> > > but it is not.
> > >
> >
> > Does this patch fix any actual observed problem?
I don't think so, this fix is more theoretical than practical.
However, maybe there is some crazy driver that fills array of 2GB with
s*printf().
> > > Compile tested.
> > >
> >
> > I guess not.
What do you mean here?
$ make lib/vsprintf.o
CHK include/linux/version.h
CHK include/generated/utsrelease.h
CALL scripts/checksyscalls.sh
CC lib/vsprintf.o
Compiled without warnings.
> > > /* Reject out-of-range values early. Large positive sizes are
> > > used for unknown buffer sizes. */
> >
> > Thousands of people would find that comment to be utterly mysterious.
> > I am one.
> >
[...]
> The changelog is wrong: if sizeof(size_t) > sizeof(int) then the return value overflows.
This comparison is intended for size_t _underflow_, e.g. in such (buggy)
code:
len = snprintf(buf, sizeof(buf), "%s", string);
len += snprintf(buf + len, sizeof(buf) - len, "%s", string2);
If the first snprintf() returns len that is greater than sizeof(buf),
then sizeof(buf)-len is negative; casted to (unsigned!) size_t it
becomes some big value. buf+len points to somewhere after the real buf.
To detect this situation we check whether size is negative (as signed).
But it should be checked as integer of the same size.
> vsprintf() and sprintf() pass INT_MAX for an unbounded buffer length
OK, this should be changed to LONG_MAX.
> The type of interest is not of the passed size, but rather the return value of
> the function.
>From vsnprintf comment:
* The return value is the number of characters which would
* be generated for the given input, excluding the trailing
If nothing was filled then result is zero.
>
> > > - if (WARN_ON_ONCE((int) size < 0))
> > > + if (WARN_ON_ONCE((ssize_t) size < 0))
> > > return 0;
> > >
> > > str = buf;
--
Vasiliy
On Thu, 11 Nov 2010, Vasiliy Kulikov wrote:
> > > > "size" is size_t. If we want to check whether it was underflowed
> > > > then we should cast it to ssize_t instead of int. When
> > > > sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> > > > but it is not.
> > > >
> > >
> > > Does this patch fix any actual observed problem?
>
> I don't think so, this fix is more theoretical than practical.
> However, maybe there is some crazy driver that fills array of 2GB with
> s*printf().
>
All sizes passed to vsprintf() greater than INT_MAX are invalid; that's
what the original code is testing, warning, and handling correctly.
> > > > Compile tested.
> > > >
> > >
> > > I guess not.
>
> What do you mean here?
>
> $ make lib/vsprintf.o
> CHK include/linux/version.h
> CHK include/generated/utsrelease.h
> CALL scripts/checksyscalls.sh
> CC lib/vsprintf.o
>
> Compiled without warnings.
>
Andrew was commenting that this was the only additional information you
provided instead of showing a working example.
> > > > /* Reject out-of-range values early. Large positive sizes are
> > > > used for unknown buffer sizes. */
> > >
> > > Thousands of people would find that comment to be utterly mysterious.
> > > I am one.
> > >
> [...]
> > The changelog is wrong: if sizeof(size_t) > sizeof(int) then the return value overflows.
>
> This comparison is intended for size_t _underflow_, e.g. in such (buggy)
> code:
>
> len = snprintf(buf, sizeof(buf), "%s", string);
> len += snprintf(buf + len, sizeof(buf) - len, "%s", string2);
>
That's buggy because len may be greater than sizeof(buf). snprintf()
returns the number of characters that would have been generated if it
wasn't truncated so that we can test that value upon return.
> If the first snprintf() returns len that is greater than sizeof(buf),
> then sizeof(buf)-len is negative; casted to (unsigned!) size_t it
> becomes some big value. buf+len points to somewhere after the real buf.
>
Right, that's the behavior of snprintf(), but that doesn't mean the passed
size can be anything larger than INT_MAX.
> To detect this situation we check whether size is negative (as signed).
> But it should be checked as integer of the same size.
>
> > vsprintf() and sprintf() pass INT_MAX for an unbounded buffer length
>
> OK, this should be changed to LONG_MAX.
>
No, it shouldn't, these functions return int. INT_MAX is the largest
value we can handle successfully and that's why it is the special case for
sprintf() and vsprintf().
The code as it stands is correct not because of the type of the size but
rather the type of the return value.
On Thu, Nov 11, 2010 at 12:38 -0800, David Rientjes wrote:
> On Thu, 11 Nov 2010, Vasiliy Kulikov wrote:
>
> > > > > "size" is size_t. If we want to check whether it was underflowed
> > > > > then we should cast it to ssize_t instead of int. When
> > > > > sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> > > > > but it is not.
> > > > >
> > > >
> > > > Does this patch fix any actual observed problem?
> >
> > I don't think so, this fix is more theoretical than practical.
> > However, maybe there is some crazy driver that fills array of 2GB with
> > s*printf().
> >
>
> All sizes passed to vsprintf() greater than INT_MAX are invalid; that's
> what the original code is testing, warning, and handling correctly.
Not always correctly:
(int)(0xFFFFFFFFL + 2) = 1 is positive.
> No, it shouldn't, these functions return int. INT_MAX is the largest
> value we can handle successfully and that's why it is the special case for
> sprintf() and vsprintf().
>
> The code as it stands is correct not because of the type of the size but
> rather the type of the return value.
OK, if the main reason here is return value type, then the correct
handling should be:
/* Reject out-of-range values early. Large positive sizes are
used for unknown buffer sizes. */
- if (WARN_ON_ONCE((int) size < 0))
+ if (WARN_ON_ONCE(size > INT_MAX)
return 0;
This should catch all underflows and too big integers.
--
Vasiliy
On Fri, 12 Nov 2010, Vasiliy Kulikov wrote:
> OK, if the main reason here is return value type, then the correct
> handling should be:
>
> /* Reject out-of-range values early. Large positive sizes are
> used for unknown buffer sizes. */
> - if (WARN_ON_ONCE((int) size < 0))
> + if (WARN_ON_ONCE(size > INT_MAX)
> return 0;
>
> This should catch all underflows and too big integers.
>
That is equivalent since size_t is always unsigned; if you'd like to
change it, it should be presented only as a style change. More important
would be writing a less cryptic comment :)
On Thu, Nov 11, 2010 at 13:34 -0800, David Rientjes wrote:
> On Fri, 12 Nov 2010, Vasiliy Kulikov wrote:
> > OK, if the main reason here is return value type, then the correct
> > handling should be:
> >
> > /* Reject out-of-range values early. Large positive sizes are
> > used for unknown buffer sizes. */
> > - if (WARN_ON_ONCE((int) size < 0))
> > + if (WARN_ON_ONCE(size > INT_MAX)
> > return 0;
> >
> > This should catch all underflows and too big integers.
> >
>
> That is equivalent since size_t is always unsigned;
Not equivalent:
void test_size(size_t size)
{
char buffer[128];
sprintf(buffer, "size %lx is BAD", size);
snprintf(buffer, size, "size %lx is OK", size);
pr_info("%s\n", buffer);
if (size > INT_MAX)
pr_info("%lx is catched by (size) > INT_MAX", size);
}
static int init(void) {
test_size(0x7FFFFFFF);
test_size(0x80000000);
test_size(0x80000001);
test_size(0xFFFFFFFF);
test_size(0x100000000);
test_size(0x100000001);
test_size(0x17fffffff);
test_size(0x180000000);
test_size(0x180000001);
return 0;
}
Output on x86_64:
[12486.542047] size 7fffffff is OK
[12486.542051] size 80000000 is BAD
[12486.542053] 80000000 is catched by (size) > INT_MAX
[12486.542055] size 80000001 is BAD
[12486.542057] 80000001 is catched by (size) > INT_MAX
[12486.542059] size ffffffff is BAD
[12486.542061] ffffffff is catched by (size) > INT_MAX
[12486.542063] size 100000000 is OK
[12486.542065] 100000000 is catched by (size) > INT_MAX
[12486.542067] size 100000001 is OK
[12486.542069] 100000001 is catched by (size) > INT_MAX
[12486.542071] size 17fffffff is OK
[12486.542073] 17fffffff is catched by (size) > INT_MAX
[12486.542075] size 180000000 is BAD
[12486.542077] 180000000 is catched by (size) > INT_MAX
[12486.542079] size 180000001 is BAD
[12486.542081] 180000001 is catched by (size) > INT_MAX
--
Vasiliy