Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755688Ab3ILH66 (ORCPT ); Thu, 12 Sep 2013 03:58:58 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:30635 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753635Ab3ILH65 (ORCPT ); Thu, 12 Sep 2013 03:58:57 -0400 Date: Thu, 12 Sep 2013 10:57:57 +0300 From: Dan Carpenter To: Jan Beulich Cc: Kees Cook , Joe Perches , David Miller , Eldad Zack , George Spelvin , Randy Dunlap , Andrew Morton , Jiri Kosina , LKML Subject: Re: [PATCH] vsprintf: drop comment claiming %n is ignored Message-ID: <20130912075756.GG19256@mwanda> References: <20130911193040.GA16688@www.outflux.net> <1378929961.4714.21.camel@joe-AO722> <5231836102000078000F29AD@nat28.tlf.novell.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5231836102000078000F29AD@nat28.tlf.novell.com> User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1599 Lines: 36 On Thu, Sep 12, 2013 at 08:03:29AM +0100, Jan Beulich wrote: > >>> On 11.09.13 at 22:18, Kees Cook wrote: > > On Wed, Sep 11, 2013 at 1:06 PM, Joe Perches wrote: > >> On Wed, 2013-09-11 at 12:30 -0700, Kees Cook wrote: > >>> The %n format is not ignored, so remove the incorrect comment about it. > >> > >> I think it may be better to reimplement the ignoring. > > > > Yeah, just had a quick look, and scanf doesn't use this code at all. > > I'd much rather remove %n again instead. > > Why would you want to artificially make the function diverge > from the spec? People shouldn't be caught by surprises if at all > possible, and one can certainly not expect people to go look at > the comment before the function implementation to find out > what basic (standard) features _do not_ work (one can expect > so when trying to find out about _extensions_). > > Jan Actually it's the reverse. I was expecting that %n would be ignored from the start. Then I looked at the file and the comment said that %n was ignored. It's only Kees who looked at the actual code and saw that it wasn't being ignored since 2009. Kees has been fixing format strings bugs in the past few months and there are probably other out of tree drivers where this bug is still exploitable. It's quite serious. regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/