public inbox for linux-hardening@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH v8 0/5] lib and lib/cmdline enhancements
@ 2026-02-12 16:44 Dmitry Antipov
  2026-02-12 16:44 ` [PATCH v8 1/5] lib: fix _parse_integer_limit() to handle overflow Dmitry Antipov
                   ` (5 more replies)
  0 siblings, 6 replies; 15+ messages in thread
From: Dmitry Antipov @ 2026-02-12 16:44 UTC (permalink / raw)
  To: Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel, Dmitry Antipov

Adjust '_parse_integer_limit()' and 'memparse()' to not ignore
overflows, extend string to 64-bit integer conversion tests, add
KUnit-based test for 'memparse()' and fix kernel-doc glitches
found in lib/cmdline.c.

Dmitry Antipov (5):
  lib: fix _parse_integer_limit() to handle overflow
  lib: fix memparse() to handle overflow
  lib: add more string to 64-bit integer conversion overflow tests
  lib/cmdline_kunit: add test case for memparse()
  lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings

 lib/cmdline.c             | 30 ++++++++++++++-------
 lib/kstrtox.c             | 37 +++++++++++++++-----------
 lib/test-kstrtox.c        |  6 +++++
 lib/tests/cmdline_kunit.c | 56 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 104 insertions(+), 25 deletions(-)

-- 
2.53.0


^ permalink raw reply	[flat|nested] 15+ messages in thread

* [PATCH v8 1/5] lib: fix _parse_integer_limit() to handle overflow
  2026-02-12 16:44 [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
@ 2026-02-12 16:44 ` Dmitry Antipov
  2026-02-12 16:44 ` [PATCH v8 2/5] lib: fix memparse() " Dmitry Antipov
                   ` (4 subsequent siblings)
  5 siblings, 0 replies; 15+ messages in thread
From: Dmitry Antipov @ 2026-02-12 16:44 UTC (permalink / raw)
  To: Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel, Dmitry Antipov

In '_parse_integer_limit()', adjust native integer arithmetic
with near-to-overflow branch where 'check_mul_overflow()' and
'check_add_overflow()' are used to check whether an intermediate
result goes out of range, and denote such a case with ULLONG_MAX,
thus making the function more similar to standard C library's
'strtoull()'. Adjust comment to kernel-doc style as well.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
v8: do not use explicit temporary in check_xxx_overflow()
    calls and handle overflow flag using separate variable
v7: drop redundant check against ULLONG_MAX and restore
    original comment
v6: more compact for-loop and minor style adjustments again
v5: minor brace style adjustment
v4: restore plain integer arithmetic and use check_xxx_overflow()
    on near-to-overflow branch only
v3: adjust commit message and comments as suggested by Andy
v2: initial version to join the series
---
 lib/kstrtox.c | 37 ++++++++++++++++++++++---------------
 1 file changed, 22 insertions(+), 15 deletions(-)

diff --git a/lib/kstrtox.c b/lib/kstrtox.c
index bdde40cd69d7..cd67f494c3bd 100644
--- a/lib/kstrtox.c
+++ b/lib/kstrtox.c
@@ -39,25 +39,30 @@ const char *_parse_integer_fixup_radix(const char *s, unsigned int *base)
 	return s;
 }
 
-/*
- * Convert non-negative integer string representation in explicitly given radix
- * to an integer. A maximum of max_chars characters will be converted.
+/**
+ * _parse_integer_limit - Convert integer string representation to an integer
+ * @s: Integer string representation
+ * @base: Radix
+ * @p: Where to store result
+ * @max_chars: Maximum amount of characters to convert
+ *
+ * Convert non-negative integer string representation in explicitly given
+ * radix to an integer. If overflow occurs, value at @p is set to ULLONG_MAX.
  *
- * Return number of characters consumed maybe or-ed with overflow bit.
- * If overflow occurs, result integer (incorrect) is still returned.
+ * This function is the workhorse of other string conversion functions and it
+ * is discouraged to use it explicitly. Consider kstrto*() family instead.
  *
- * Don't you dare use this function.
+ * Return: Number of characters consumed, maybe ORed with overflow bit
  */
 noinline
 unsigned int _parse_integer_limit(const char *s, unsigned int base, unsigned long long *p,
 				  size_t max_chars)
 {
+	unsigned int rv, overflow = 0;
 	unsigned long long res;
-	unsigned int rv;
 
 	res = 0;
-	rv = 0;
-	while (max_chars--) {
+	for (rv = 0; rv < max_chars; rv++, s++) {
 		unsigned int c = *s;
 		unsigned int lc = _tolower(c);
 		unsigned int val;
@@ -76,15 +81,17 @@ unsigned int _parse_integer_limit(const char *s, unsigned int base, unsigned lon
 		 * it in the max base we support (16)
 		 */
 		if (unlikely(res & (~0ull << 60))) {
-			if (res > div_u64(ULLONG_MAX - val, base))
-				rv |= KSTRTOX_OVERFLOW;
+			if (check_mul_overflow(res, base, &res) ||
+			    check_add_overflow(res, val, &res)) {
+				res = ULLONG_MAX;
+				overflow = KSTRTOX_OVERFLOW;
+			}
+		} else {
+			res = res * base + val;
 		}
-		res = res * base + val;
-		rv++;
-		s++;
 	}
 	*p = res;
-	return rv;
+	return rv | overflow;
 }
 
 noinline
-- 
2.53.0


^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH v8 2/5] lib: fix memparse() to handle overflow
  2026-02-12 16:44 [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
  2026-02-12 16:44 ` [PATCH v8 1/5] lib: fix _parse_integer_limit() to handle overflow Dmitry Antipov
@ 2026-02-12 16:44 ` Dmitry Antipov
  2026-02-24 12:32   ` Rodrigo Alencar
  2026-02-12 16:44 ` [PATCH v8 3/5] lib: add more string to 64-bit integer conversion overflow tests Dmitry Antipov
                   ` (3 subsequent siblings)
  5 siblings, 1 reply; 15+ messages in thread
From: Dmitry Antipov @ 2026-02-12 16:44 UTC (permalink / raw)
  To: Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel, Dmitry Antipov

Since '_parse_integer_limit()' (and so 'simple_strtoull()') is now
capable to handle overflow, adjust 'memparse()' to handle overflow
(denoted by ULLONG_MAX) returned from 'simple_strtoull()'. Also
use 'check_shl_overflow()' to catch an overflow possibly caused
by processing size suffix and denote it with ULLONG_MAX as well.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
v8: do not use temporary in check_shl_overflow()
v7: do not double-adjust endptr and drop
    redundant check against ULLONG_MAX
v6: handle valid-suffix-only string like "k"
    as unrecognized, minor style adjustments
v5: initial version to join the series
---
 lib/cmdline.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/lib/cmdline.c b/lib/cmdline.c
index 90ed997d9570..f6e4b113ca9f 100644
--- a/lib/cmdline.c
+++ b/lib/cmdline.c
@@ -150,39 +150,46 @@ EXPORT_SYMBOL(get_options);
 unsigned long long memparse(const char *ptr, char **retptr)
 {
 	char *endptr;	/* local pointer to end of parsed string */
-
 	unsigned long long ret = simple_strtoull(ptr, &endptr, 0);
+	unsigned int shl = 0;
 
+	/* Consume valid suffix even in case of overflow. */
 	switch (*endptr) {
 	case 'E':
 	case 'e':
-		ret <<= 10;
+		shl += 10;
 		fallthrough;
 	case 'P':
 	case 'p':
-		ret <<= 10;
+		shl += 10;
 		fallthrough;
 	case 'T':
 	case 't':
-		ret <<= 10;
+		shl += 10;
 		fallthrough;
 	case 'G':
 	case 'g':
-		ret <<= 10;
+		shl += 10;
 		fallthrough;
 	case 'M':
 	case 'm':
-		ret <<= 10;
+		shl += 10;
 		fallthrough;
 	case 'K':
 	case 'k':
-		ret <<= 10;
-		endptr++;
+		shl += 10;
 		fallthrough;
 	default:
 		break;
 	}
 
+	if (shl && likely(ptr != endptr)) {
+		/* Have valid suffix with preceding number. */
+		if (unlikely(check_shl_overflow(ret, shl, &ret)))
+			ret = ULLONG_MAX;
+		endptr++;
+	}
+
 	if (retptr)
 		*retptr = endptr;
 
-- 
2.53.0


^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH v8 3/5] lib: add more string to 64-bit integer conversion overflow tests
  2026-02-12 16:44 [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
  2026-02-12 16:44 ` [PATCH v8 1/5] lib: fix _parse_integer_limit() to handle overflow Dmitry Antipov
  2026-02-12 16:44 ` [PATCH v8 2/5] lib: fix memparse() " Dmitry Antipov
@ 2026-02-12 16:44 ` Dmitry Antipov
  2026-02-12 16:44 ` [PATCH v8 4/5] lib/cmdline_kunit: add test case for memparse() Dmitry Antipov
                   ` (2 subsequent siblings)
  5 siblings, 0 replies; 15+ messages in thread
From: Dmitry Antipov @ 2026-02-12 16:44 UTC (permalink / raw)
  To: Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel, Dmitry Antipov

Add a few more string to 64-bit integer conversion tests to
check whether 'kstrtoull()', 'kstrtoll()', 'kstrtou64()' and
'kstrtos64()' can handle overflows reported by
'_parse_integer_limit()'.

Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
v5 and upwards: bump version to match the series
v4: initial version to join the series
---
 lib/test-kstrtox.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/test-kstrtox.c b/lib/test-kstrtox.c
index ee87fef66cb5..811128d0df16 100644
--- a/lib/test-kstrtox.c
+++ b/lib/test-kstrtox.c
@@ -198,6 +198,7 @@ static void __init test_kstrtoull_fail(void)
 		{"10000000000000000000000000000000000000000000000000000000000000000",	2},
 		{"2000000000000000000000",	8},
 		{"18446744073709551616",	10},
+		{"569202370375329612767",	10},
 		{"10000000000000000",	16},
 		/* negative */
 		{"-0", 0},
@@ -275,9 +276,11 @@ static void __init test_kstrtoll_fail(void)
 		{"9223372036854775809",	10},
 		{"18446744073709551614",	10},
 		{"18446744073709551615",	10},
+		{"569202370375329612767",	10},
 		{"-9223372036854775809",	10},
 		{"-18446744073709551614",	10},
 		{"-18446744073709551615",	10},
+		{"-569202370375329612767",	10},
 		/* sign is first character if any */
 		{"-+1", 0},
 		{"-+1", 8},
@@ -334,6 +337,7 @@ static void __init test_kstrtou64_fail(void)
 		{"-1",	10},
 		{"18446744073709551616",	10},
 		{"18446744073709551617",	10},
+		{"569202370375329612767",	10},
 	};
 	TEST_FAIL(kstrtou64, u64, "%llu", test_u64_fail);
 }
@@ -386,6 +390,8 @@ static void __init test_kstrtos64_fail(void)
 		{"18446744073709551615",	10},
 		{"18446744073709551616",	10},
 		{"18446744073709551617",	10},
+		{"569202370375329612767",	10},
+		{"-569202370375329612767",	10},
 	};
 	TEST_FAIL(kstrtos64, s64, "%lld", test_s64_fail);
 }
-- 
2.53.0


^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH v8 4/5] lib/cmdline_kunit: add test case for memparse()
  2026-02-12 16:44 [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
                   ` (2 preceding siblings ...)
  2026-02-12 16:44 ` [PATCH v8 3/5] lib: add more string to 64-bit integer conversion overflow tests Dmitry Antipov
@ 2026-02-12 16:44 ` Dmitry Antipov
  2026-02-12 16:44 ` [PATCH v8 5/5] lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings Dmitry Antipov
  2026-02-18 13:40 ` [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
  5 siblings, 0 replies; 15+ messages in thread
From: Dmitry Antipov @ 2026-02-12 16:44 UTC (permalink / raw)
  To: Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel, Dmitry Antipov

Better late than never, now there is a long-awaited basic
test for 'memparse()' which is provided by cmdline.c.

Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
v7 and upwards: bump version to match the series
v6: tests to check whether valid-suffix-only string is handled as unrecognized
v5: even more tests to trigger overflow with size suffix
v4: move actual overflow tests to test-kstrtox.c
v3: adjust style as suggested by Andy
v2: few more test cases to trigger overflows
---
 lib/tests/cmdline_kunit.c | 56 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/lib/tests/cmdline_kunit.c b/lib/tests/cmdline_kunit.c
index c1602f797637..18b19c85baef 100644
--- a/lib/tests/cmdline_kunit.c
+++ b/lib/tests/cmdline_kunit.c
@@ -6,6 +6,7 @@
 #include <kunit/test.h>
 #include <linux/kernel.h>
 #include <linux/random.h>
+#include <linux/sizes.h>
 #include <linux/string.h>
 
 static const char *cmdline_test_strings[] = {
@@ -139,11 +140,66 @@ static void cmdline_test_range(struct kunit *test)
 	} while (++i < ARRAY_SIZE(cmdline_test_range_strings));
 }
 
+struct cmdline_test_memparse_entry {
+	const char *input;
+	const char *unrecognized;
+	unsigned long long result;
+};
+
+static const struct cmdline_test_memparse_entry testdata[] = {
+	{ "0",				"",	0ULL },
+	{ "1",				"",	1ULL },
+	{ "a",				"a",	0ULL },
+	{ "k",				"k",	0ULL },
+	{ "E",				"E",	0ULL },
+	{ "0xb",			"",	11ULL },
+	{ "0xz",			"x",	0ULL },
+	{ "1234",			"",	1234ULL },
+	{ "04567",			"",	2423ULL },
+	{ "0x9876",			"",	39030LL },
+	{ "05678",			"8",	375ULL },
+	{ "0xabcdefz",			"z",	11259375ULL },
+	{ "0cdba",			"c",	0ULL },
+	{ "4K",				"",	SZ_4K },
+	{ "0x10k@0xaaaabbbb",		"@",	SZ_16K },
+	{ "32M",			"",	SZ_32M },
+	{ "067m:foo",			":",	55 * SZ_1M },
+	{ "2G;bar=baz",			";",	SZ_2G },
+	{ "07gz",			"z",	7ULL * SZ_1G },
+	{ "3T+data",			"+",	3 * SZ_1T },
+	{ "04t,ro",			",",	SZ_4T },
+	{ "012p",			"",	11258999068426240ULL },
+	{ "7P,sync",			",",	7881299347898368ULL },
+	{ "0x2e",			"",	46ULL },
+	{ "2E and more",		" ",	2305843009213693952ULL },
+	{ "18446744073709551615",	"",	ULLONG_MAX },
+	{ "0xffffffffffffffff0",	"",	ULLONG_MAX },
+	{ "1111111111111111111T",	"",	ULLONG_MAX },
+	{ "222222222222222222222G",	"",	ULLONG_MAX },
+	{ "3333333333333333333333M",	"",	ULLONG_MAX },
+};
+
+static void cmdline_test_memparse(struct kunit *test)
+{
+	const struct cmdline_test_memparse_entry *e;
+	unsigned long long ret;
+	char *retptr;
+
+	for (e = testdata; e < testdata + ARRAY_SIZE(testdata); e++) {
+		ret = memparse(e->input, &retptr);
+		KUNIT_EXPECT_EQ_MSG(test, ret, e->result,
+				    "    when parsing '%s'", e->input);
+		KUNIT_EXPECT_EQ_MSG(test, *retptr, *e->unrecognized,
+				    "    when parsing '%s'", e->input);
+	}
+}
+
 static struct kunit_case cmdline_test_cases[] = {
 	KUNIT_CASE(cmdline_test_noint),
 	KUNIT_CASE(cmdline_test_lead_int),
 	KUNIT_CASE(cmdline_test_tail_int),
 	KUNIT_CASE(cmdline_test_range),
+	KUNIT_CASE(cmdline_test_memparse),
 	{}
 };
 
-- 
2.53.0


^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH v8 5/5] lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings
  2026-02-12 16:44 [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
                   ` (3 preceding siblings ...)
  2026-02-12 16:44 ` [PATCH v8 4/5] lib/cmdline_kunit: add test case for memparse() Dmitry Antipov
@ 2026-02-12 16:44 ` Dmitry Antipov
  2026-02-18 13:40 ` [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
  5 siblings, 0 replies; 15+ messages in thread
From: Dmitry Antipov @ 2026-02-12 16:44 UTC (permalink / raw)
  To: Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel, Dmitry Antipov

Fix 'get_option()', 'memparse()' and 'parse_option_str()' comments
to match the commonly used style as suggested by kernel-doc -Wreturn.

Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
v2 and upwards: bump version to match the series
---
 lib/cmdline.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/cmdline.c b/lib/cmdline.c
index f6e4b113ca9f..16cce6621cec 100644
--- a/lib/cmdline.c
+++ b/lib/cmdline.c
@@ -43,7 +43,7 @@ static int get_range(char **str, int *pint, int n)
  *	When @pint is NULL the function can be used as a validator of
  *	the current option in the string.
  *
- *	Return values:
+ *	Return:
  *	0 - no int in string
  *	1 - int found, no subsequent comma
  *	2 - int found including a subsequent comma
@@ -145,6 +145,9 @@ EXPORT_SYMBOL(get_options);
  *
  *	Parses a string into a number.  The number stored at @ptr is
  *	potentially suffixed with K, M, G, T, P, E.
+ *
+ *	Return: The value as recognized by simple_strtoull() multiplied
+ *	by the value as specified by suffix, if any.
  */
 
 unsigned long long memparse(const char *ptr, char **retptr)
@@ -205,7 +208,7 @@ EXPORT_SYMBOL(memparse);
  *	This function parses a string containing a comma-separated list of
  *	strings like a=b,c.
  *
- *	Return true if there's such option in the string, or return false.
+ *	Return: True if there's such option in the string or false otherwise.
  */
 bool parse_option_str(const char *str, const char *option)
 {
-- 
2.53.0


^ permalink raw reply related	[flat|nested] 15+ messages in thread

* Re: [PATCH v8 0/5] lib and lib/cmdline enhancements
  2026-02-12 16:44 [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
                   ` (4 preceding siblings ...)
  2026-02-12 16:44 ` [PATCH v8 5/5] lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings Dmitry Antipov
@ 2026-02-18 13:40 ` Dmitry Antipov
  2026-02-18 13:48   ` Andy Shevchenko
  5 siblings, 1 reply; 15+ messages in thread
From: Dmitry Antipov @ 2026-02-18 13:40 UTC (permalink / raw)
  To: Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel

On Thu, 2026-02-12 at 19:44 +0300, Dmitry Antipov wrote:

> Adjust '_parse_integer_limit()' and 'memparse()' to not ignore
> overflows, extend string to 64-bit integer conversion tests, add
> KUnit-based test for 'memparse()' and fix kernel-doc glitches
> found in lib/cmdline.c.
> 
> Dmitry Antipov (5):
>   lib: fix _parse_integer_limit() to handle overflow
>   lib: fix memparse() to handle overflow
>   lib: add more string to 64-bit integer conversion overflow tests
>   lib/cmdline_kunit: add test case for memparse()
>   lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings

Any chance to move forward with this?

Dmitry

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v8 0/5] lib and lib/cmdline enhancements
  2026-02-18 13:40 ` [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
@ 2026-02-18 13:48   ` Andy Shevchenko
  2026-04-02  6:56     ` Dmitry Antipov
  0 siblings, 1 reply; 15+ messages in thread
From: Andy Shevchenko @ 2026-02-18 13:48 UTC (permalink / raw)
  To: Dmitry Antipov
  Cc: Andrew Morton, David Laight, Kees Cook, Darrick J . Wong,
	linux-hardening, linux-kernel

On Wed, Feb 18, 2026 at 04:40:28PM +0300, Dmitry Antipov wrote:
> On Thu, 2026-02-12 at 19:44 +0300, Dmitry Antipov wrote:
> 
> > Adjust '_parse_integer_limit()' and 'memparse()' to not ignore
> > overflows, extend string to 64-bit integer conversion tests, add
> > KUnit-based test for 'memparse()' and fix kernel-doc glitches
> > found in lib/cmdline.c.
> > 
> > Dmitry Antipov (5):
> >   lib: fix _parse_integer_limit() to handle overflow
> >   lib: fix memparse() to handle overflow
> >   lib: add more string to 64-bit integer conversion overflow tests
> >   lib/cmdline_kunit: add test case for memparse()
> >   lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings
> 
> Any chance to move forward with this?

I think it's a grace period due to ongoing merge window.
Also we need more input on the first patch from others,
perhaps Kees and Andrew can take a look when they will be
less busy.

-- 
With Best Regards,
Andy Shevchenko



^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v8 2/5] lib: fix memparse() to handle overflow
  2026-02-12 16:44 ` [PATCH v8 2/5] lib: fix memparse() " Dmitry Antipov
@ 2026-02-24 12:32   ` Rodrigo Alencar
  2026-02-24 14:15     ` Rodrigo Alencar
  0 siblings, 1 reply; 15+ messages in thread
From: Rodrigo Alencar @ 2026-02-24 12:32 UTC (permalink / raw)
  To: Dmitry Antipov, Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel

On 26/02/12 07:44PM, Dmitry Antipov wrote:
> Since '_parse_integer_limit()' (and so 'simple_strtoull()') is now
> capable to handle overflow, adjust 'memparse()' to handle overflow
> (denoted by ULLONG_MAX) returned from 'simple_strtoull()'. Also
> use 'check_shl_overflow()' to catch an overflow possibly caused
> by processing size suffix and denote it with ULLONG_MAX as well.

is returning ULLONG_MAX the proper way to indicate overflow with
simple_strtoull()?

...

>  unsigned long long memparse(const char *ptr, char **retptr)
>  {
>  	char *endptr;	/* local pointer to end of parsed string */
> -
>  	unsigned long long ret = simple_strtoull(ptr, &endptr, 0);

... or a new wrapper for _parse_integer_limit() is needed?

I am interested on having _parse_integer_limit() overflow check
exposed to kernel modules.
...

-- 
Kind regards,

Rodrigo Alencar

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v8 2/5] lib: fix memparse() to handle overflow
  2026-02-24 12:32   ` Rodrigo Alencar
@ 2026-02-24 14:15     ` Rodrigo Alencar
  2026-02-25  6:58       ` Dmitry Antipov
  0 siblings, 1 reply; 15+ messages in thread
From: Rodrigo Alencar @ 2026-02-24 14:15 UTC (permalink / raw)
  To: Rodrigo Alencar, Dmitry Antipov, Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel

On 26/02/24 12:32PM, Rodrigo Alencar wrote:
> On 26/02/12 07:44PM, Dmitry Antipov wrote:
> > Since '_parse_integer_limit()' (and so 'simple_strtoull()') is now
> > capable to handle overflow, adjust 'memparse()' to handle overflow
> > (denoted by ULLONG_MAX) returned from 'simple_strtoull()'. Also
> > use 'check_shl_overflow()' to catch an overflow possibly caused
> > by processing size suffix and denote it with ULLONG_MAX as well.
> 
> is returning ULLONG_MAX the proper way to indicate overflow with
> simple_strtoull()?
> 
> ...
> 
> >  unsigned long long memparse(const char *ptr, char **retptr)
> >  {
> >  	char *endptr;	/* local pointer to end of parsed string */
> > -
> >  	unsigned long long ret = simple_strtoull(ptr, &endptr, 0);
> 
> ... or a new wrapper for _parse_integer_limit() is needed?
> 
> I am interested on having _parse_integer_limit() overflow check
> exposed to kernel modules.
> ...

I could propose the exposure of simple_strntoull() which is private
to lib/vsprintf.c, slightly changing its prototype:

* from:
unsigned long long simple_strntoull(const char *startp,
				    char **endp,
				    unsigned int base,
				    size_t max_chars)
* to:
int simple_strntoull(const char *startp,
		     char **endp,
		     unsigned long long *result,
		     unsigned int base,
		     size_t max_chars)

That would allow to tackle the FIXME tag. I suppose it is there
because the overflow flag is being ignored, so the returned integer
can be set to -ERANGE or -EOVERFLOW when overflow happens.

-- 
Kind regards,

Rodrigo Alencar

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v8 2/5] lib: fix memparse() to handle overflow
  2026-02-24 14:15     ` Rodrigo Alencar
@ 2026-02-25  6:58       ` Dmitry Antipov
  0 siblings, 0 replies; 15+ messages in thread
From: Dmitry Antipov @ 2026-02-25  6:58 UTC (permalink / raw)
  To: Rodrigo Alencar, Andy Shevchenko, Andrew Morton
  Cc: David Laight, Kees Cook, Darrick J . Wong, linux-hardening,
	linux-kernel

On Tue, 2026-02-24 at 14:15 +0000, Rodrigo Alencar wrote:

> > I am interested on having _parse_integer_limit() overflow check
> > exposed to kernel modules.

Hm... _parse_integer_limit() may be EXPORT_SYMBOL()ed of course.
But are you sure that current API is not enough for your task?

> > ...
> 
> I could propose the exposure of simple_strntoull() which is private
> to lib/vsprintf.c, slightly changing its prototype:
> 
> * from:
> unsigned long long simple_strntoull(const char *startp,
> 				    char **endp,
> 				    unsigned int base,
> 				    size_t max_chars)
> * to:
> int simple_strntoull(const char *startp,
> 		     char **endp,
> 		     unsigned long long *result,
> 		     unsigned int base,
> 		     size_t max_chars)
> 
> That would allow to tackle the FIXME tag. I suppose it is there
> because the overflow flag is being ignored, so the returned integer
> can be set to -ERANGE or -EOVERFLOW when overflow happens.

Well, removal of KSTRTOX_OVERFLOW quirk may be a subject for the next series.

Dmitry

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v8 0/5] lib and lib/cmdline enhancements
  2026-02-18 13:48   ` Andy Shevchenko
@ 2026-04-02  6:56     ` Dmitry Antipov
  2026-04-02  8:30       ` Andy Shevchenko
  0 siblings, 1 reply; 15+ messages in thread
From: Dmitry Antipov @ 2026-04-02  6:56 UTC (permalink / raw)
  To: Andy Shevchenko
  Cc: Andrew Morton, David Laight, Kees Cook, Darrick J . Wong,
	linux-hardening, linux-kernel

On Wed, 2026-02-18 at 15:48 +0200, Andy Shevchenko wrote:

> On Wed, Feb 18, 2026 at 04:40:28PM +0300, Dmitry Antipov wrote:
> > On Thu, 2026-02-12 at 19:44 +0300, Dmitry Antipov wrote:
> > 
> > > Adjust '_parse_integer_limit()' and 'memparse()' to not ignore
> > > overflows, extend string to 64-bit integer conversion tests, add
> > > KUnit-based test for 'memparse()' and fix kernel-doc glitches
> > > found in lib/cmdline.c.
> > > 
> > > Dmitry Antipov (5):
> > >   lib: fix _parse_integer_limit() to handle overflow
> > >   lib: fix memparse() to handle overflow
> > >   lib: add more string to 64-bit integer conversion overflow tests
> > >   lib/cmdline_kunit: add test case for memparse()
> > >   lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings
> > 
> > Any chance to move forward with this?
> 
> I think it's a grace period due to ongoing merge window.
> Also we need more input on the first patch from others,
> perhaps Kees and Andrew can take a look when they will be
> less busy.

The same question again...

Dmitry

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v8 0/5] lib and lib/cmdline enhancements
  2026-04-02  6:56     ` Dmitry Antipov
@ 2026-04-02  8:30       ` Andy Shevchenko
  2026-04-02 16:00         ` Andrew Morton
  0 siblings, 1 reply; 15+ messages in thread
From: Andy Shevchenko @ 2026-04-02  8:30 UTC (permalink / raw)
  To: Dmitry Antipov
  Cc: Andrew Morton, David Laight, Kees Cook, Darrick J . Wong,
	linux-hardening, linux-kernel

On Thu, Apr 02, 2026 at 09:56:45AM +0300, Dmitry Antipov wrote:
> On Wed, 2026-02-18 at 15:48 +0200, Andy Shevchenko wrote:
> > On Wed, Feb 18, 2026 at 04:40:28PM +0300, Dmitry Antipov wrote:
> > > On Thu, 2026-02-12 at 19:44 +0300, Dmitry Antipov wrote:
> > > 
> > > > Adjust '_parse_integer_limit()' and 'memparse()' to not ignore
> > > > overflows, extend string to 64-bit integer conversion tests, add
> > > > KUnit-based test for 'memparse()' and fix kernel-doc glitches
> > > > found in lib/cmdline.c.
> > > > 
> > > > Dmitry Antipov (5):
> > > >   lib: fix _parse_integer_limit() to handle overflow
> > > >   lib: fix memparse() to handle overflow
> > > >   lib: add more string to 64-bit integer conversion overflow tests
> > > >   lib/cmdline_kunit: add test case for memparse()
> > > >   lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings
> > > 
> > > Any chance to move forward with this?
> > 
> > I think it's a grace period due to ongoing merge window.
> > Also we need more input on the first patch from others,
> > perhaps Kees and Andrew can take a look when they will be
> > less busy.
> 
> The same question again...

I'm not sure why. The patches are in Linux Next for several days already.
$ git tag --contains b85c7e022e1c # the last one
next-20260401

Yet it needs to be merged into nomm-stable (if I understood the process right).

-- 
With Best Regards,
Andy Shevchenko



^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v8 0/5] lib and lib/cmdline enhancements
  2026-04-02  8:30       ` Andy Shevchenko
@ 2026-04-02 16:00         ` Andrew Morton
  2026-04-02 16:09           ` Andy Shevchenko
  0 siblings, 1 reply; 15+ messages in thread
From: Andrew Morton @ 2026-04-02 16:00 UTC (permalink / raw)
  To: Andy Shevchenko
  Cc: Dmitry Antipov, David Laight, Kees Cook, Darrick J . Wong,
	linux-hardening, linux-kernel

On Thu, 2 Apr 2026 11:30:43 +0300 Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> > > > >   lib/cmdline_kunit: add test case for memparse()
> > > > >   lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings
> > > > 
> > > > Any chance to move forward with this?
> > > 
> > > I think it's a grace period due to ongoing merge window.
> > > Also we need more input on the first patch from others,
> > > perhaps Kees and Andrew can take a look when they will be
> > > less busy.
> > 
> > The same question again...
> 
> I'm not sure why. The patches are in Linux Next for several days already.
> $ git tag --contains b85c7e022e1c # the last one
> next-20260401
> 
> Yet it needs to be merged into nomm-stable (if I understood the process right).

Yes, these are on track for the upcoming merge window.

However I believe the riscv32 build breakage remains unresolved?

https://lore.kernel.org/all/202603041925.KLKqpK6N-lkp@intel.com/T/#u

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH v8 0/5] lib and lib/cmdline enhancements
  2026-04-02 16:00         ` Andrew Morton
@ 2026-04-02 16:09           ` Andy Shevchenko
  0 siblings, 0 replies; 15+ messages in thread
From: Andy Shevchenko @ 2026-04-02 16:09 UTC (permalink / raw)
  To: Andrew Morton
  Cc: Dmitry Antipov, David Laight, Kees Cook, Darrick J . Wong,
	linux-hardening, linux-kernel

On Thu, Apr 02, 2026 at 09:00:30AM -0700, Andrew Morton wrote:
> On Thu, 2 Apr 2026 11:30:43 +0300 Andy Shevchenko <andriy.shevchenko@intel.com> wrote:
> > > > > >   lib/cmdline_kunit: add test case for memparse()
> > > > > >   lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings
> > > > > 
> > > > > Any chance to move forward with this?
> > > > 
> > > > I think it's a grace period due to ongoing merge window.
> > > > Also we need more input on the first patch from others,
> > > > perhaps Kees and Andrew can take a look when they will be
> > > > less busy.
> > > 
> > > The same question again...
> > 
> > I'm not sure why. The patches are in Linux Next for several days already.
> > $ git tag --contains b85c7e022e1c # the last one
> > next-20260401
> > 
> > Yet it needs to be merged into nomm-stable (if I understood the process right).
> 
> Yes, these are on track for the upcoming merge window.
> 
> However I believe the riscv32 build breakage remains unresolved?
> 
> https://lore.kernel.org/all/202603041925.KLKqpK6N-lkp@intel.com/T/#u

I haven't heard any move of that. Ard proposed a fix/workaround. Nobody seems care.
So I think leaving it as is is also okay as risc-v people simply do not care.
Alternatively we may apply one of the suggested approaches: disabling EFI for 32-bit
or a patch that enables shift from a GCC library — in-kernel copy of it.

-- 
With Best Regards,
Andy Shevchenko



^ permalink raw reply	[flat|nested] 15+ messages in thread

end of thread, other threads:[~2026-04-02 16:09 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-12 16:44 [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
2026-02-12 16:44 ` [PATCH v8 1/5] lib: fix _parse_integer_limit() to handle overflow Dmitry Antipov
2026-02-12 16:44 ` [PATCH v8 2/5] lib: fix memparse() " Dmitry Antipov
2026-02-24 12:32   ` Rodrigo Alencar
2026-02-24 14:15     ` Rodrigo Alencar
2026-02-25  6:58       ` Dmitry Antipov
2026-02-12 16:44 ` [PATCH v8 3/5] lib: add more string to 64-bit integer conversion overflow tests Dmitry Antipov
2026-02-12 16:44 ` [PATCH v8 4/5] lib/cmdline_kunit: add test case for memparse() Dmitry Antipov
2026-02-12 16:44 ` [PATCH v8 5/5] lib/cmdline: adjust a few comments to fix kernel-doc -Wreturn warnings Dmitry Antipov
2026-02-18 13:40 ` [PATCH v8 0/5] lib and lib/cmdline enhancements Dmitry Antipov
2026-02-18 13:48   ` Andy Shevchenko
2026-04-02  6:56     ` Dmitry Antipov
2026-04-02  8:30       ` Andy Shevchenko
2026-04-02 16:00         ` Andrew Morton
2026-04-02 16:09           ` Andy Shevchenko

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox