From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18BD6C83F1A for ; Thu, 10 Jul 2025 23:24:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 742F26B009A; Thu, 10 Jul 2025 19:24:00 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 71A7C6B009B; Thu, 10 Jul 2025 19:24:00 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 658626B009D; Thu, 10 Jul 2025 19:24:00 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 5605B6B009A for ; Thu, 10 Jul 2025 19:24:00 -0400 (EDT) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 9929212C88F for ; Thu, 10 Jul 2025 23:23:59 +0000 (UTC) X-FDA: 83649934998.11.0937C02 Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by imf17.hostedemail.com (Postfix) with ESMTP id A9ECF40004 for ; Thu, 10 Jul 2025 23:23:57 +0000 (UTC) Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=IFnRv05a; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf17.hostedemail.com: domain of alx@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=alx@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1752189837; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Cup3PyNK537Lv9LxdLhG/3+z3/ESd/NGq9+Im3jxqns=; b=0KwbhSwdpngL+3fNGi8ly6W4D6gDejf6x68DrX3Y+cxMF8yA0bs5GUPzZPeFbRbQ/pU/l7 k5ORh4/E3sDlb3vAOpjKSMMEfFN/UZrCM79RMZZ3fS2nJXX1gtAnH3vegoyWG27O8fr4dP 9+0ajkBY7fWEo8kBXZiHmehhxDpiFks= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1752189837; a=rsa-sha256; cv=none; b=WBVCNyh8SDua5CAt0OVhHn0MO/iPFUNWGO4JuLHLY9ct1t8gJ8v687rNwP/95uybFSFlAp ouwPa4yQPh2TpbGDgLto16r3aBSx5eAGZWlRtZquFBwdxQP0q6qLG0vhbLWuoKY6J+a82x 0JE9PZULd/9JeS7pbUJ3JoPvn6cNfoQ= ARC-Authentication-Results: i=1; imf17.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=IFnRv05a; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf17.hostedemail.com: domain of alx@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=alx@kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 5BB0946E60; Thu, 10 Jul 2025 23:23:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C565FC4CEE3; Thu, 10 Jul 2025 23:23:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1752189836; bh=KOQiERexs/yoLixl7P/bNkDLLxMUFU5pJHpr73kZB+U=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=IFnRv05aBMMuD/UovBMBpX3B8jxMY9f6DsVdtK63J1obMVr4sUhL5pIrBCDQ3Ezzz Yh2ec9j5axRzT0BTskYRmQdXnTJeaHXa7JDcJZC6R6U5wgNrlaGeodlPjidmoy2CAX 5sx3MLsPRN3HdfV2uPg0Z86KZpbfb3HyMqTlI5J9kr+Ow2sr+tvS9Qj8tQAxw30GA+ b4+biY5FUVNppRK5T0auXi4LzwTCsVqMxP8AMomdKW1iKEeQ1i0knwvO8GFl1oLAFv rkCVB/RHjRXdnIZk+gPMQC3VQ05OW36oBAh4uzaGectYOW+6gb/442tjmaT91vNVZ+ xXY4jFLQRDFKw== Date: Fri, 11 Jul 2025 01:23:49 +0200 From: Alejandro Colomar To: Linus Torvalds Cc: linux-mm@kvack.org, linux-hardening@vger.kernel.org, Kees Cook , Christopher Bazley , shadow <~hallyn/shadow@lists.sr.ht>, linux-kernel@vger.kernel.org, Andrew Morton , kasan-dev@googlegroups.com, Dmitry Vyukov , Alexander Potapenko , Marco Elver , Christoph Lameter , David Rientjes , Vlastimil Babka , Roman Gushchin , Harry Yoo , Andrew Clayton , Rasmus Villemoes , Michal Hocko , Al Viro , Martin Uecker , Sam James , Andrew Pinski Subject: Re: [RFC v5 6/7] sprintf: Add [v]sprintf_array() Message-ID: References: <04c1e026a67f1609167e834471d0f2fe977d9cb0.1752182685.git.alx@kernel.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="lpnpaylljl22ydn2" Content-Disposition: inline In-Reply-To: X-Rspamd-Queue-Id: A9ECF40004 X-Stat-Signature: 6zzz3jam3ssc8zpazj8swmcdw16rojyt X-Rspam-User: X-Rspamd-Server: rspam06 X-HE-Tag: 1752189837-424215 X-HE-Meta: U2FsdGVkX19ciZhWZxOz7J3BnobF6JGSJvrYbn8d7fj6F8zUlq0tQmumNn/IbuZMDZjt/gZoOx4oHsCCu3D5RQZ2UxDTMSPqYmxeUpJhmMwEO4XtUvOehaFTYgOhMGdQFJ1lhKcXEJxF32vX4nPm5A3wd9TyZWEYBIk7ct1jeEoQKYwhqDQpWGcLyAIA4dsDbwEGuuYEWN5GTQ9bVa8sf0sutMvhTjS7l8m0PjlQwdvVTmHXZT1uZZb4QgpDOnFjJbe6jtFUZCDt2mS9cbxg0TTDDAaQSp/sS1txEwcDidhQLpq5a/QxpmzFiNmA2nP3cYEUtCxDDsNCkGjIH1T6UNEYjsaMUwnLt8G5k6QDL4fs8FDO8y8Av3bmHB2V9D4OgCtL5jWTyeUt2vDTQFZkdb3DU03wjEUyygWcU97CHuI9wM5R+Ifk6WtVJN8g/HQMjjvwQaMkgKI2kmqCU/Z8VffbgTrY04TU1d3zTkPIsAYspkAaqo9sZ37wDzEy3uFwyF1StD72GUiFg2XV294wcHy59eh59Z4Q0AAmOTo26qn06V9bebX47k1J9bLcQmTURoujFOnR7cWKJxEETRBh+M17VcdJIjTxLr8nvNJHvkIq1o3enfywxiRRz7zwSjuA8ZwW6fZIoSBx/Tc1Useu+3oILLFty53pM0zUk65osyMRFxT8zAmqeYShV4nyA9nCC0ToUoyWqXDQrpgHjoGdZoobu3e3vwIiwn9owvuS+CwrzmGeeqqDf9ynU3truA2Y5X/gntUzhuhN8zFgIvrlqqPPI4xmA6MavJriuOM4O1mUFT5/KZBkt0hhgmywwYx6GFFbsckAjAzm4W20/LRl3aYTY97d3NWrJ5ewFS4kruJPZuwNL98R83G9pF3/JiknilHIRFzQe3RT77EBEZsdqiTs/RxK7u7cOgwoJTWDP4vxqbE/Qk88KE5s0NdRikoWoqET5StSm0EKpSHjw8V yDzzFTZE 0kgqDnVZSV1Hi8UsZ65Prxygc8M34Wf9AqdIKnHU5+JXq6Fk4uRCSoqs7lwKKvUDAt6vLB7Gr+Aa4+vWayZClxqdt7uKD9pDGnE8RR6Jz6gw+NuqulPT7zDrf2eAM687IsT1349hMjeUdb52kmIU0RT+zrcdX+KfrsBlwcKF7JunA9WX0br7wiQjbvQb15QDjyi9/ODSjczFK55R9I2FttJ7NyReXRtPTUnerxtgffAYEhpho7MgY+nvzt6Uwr71h6TMfgJoFvr6GNyk4POyoqngQtTpsT/aFCBfdQqHZ2Ubwtk9Vascoz1fQA8HewlP1BUpVir6XiHY2Ijxr0NDRsraD4R1ya+V0q3gysrARcsvtPwI96cQ6EWZkNmvotnwaqphWCOALlgSPf7KQvA/ueXb6YNuGn7TWQBULaWq0jA3Y2VPNVGrrfQ9tCvcjfTbTYGZYNvJvJSk015LnvFNk9wOLFfPr9eSF9n7tqUIIu8SU9uF2QbnjDCLK7nwkVDmBE2RlPoBCZJCllvuEnON0aN0sig== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: --lpnpaylljl22ydn2 Content-Type: text/plain; protected-headers=v1; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable From: Alejandro Colomar To: Linus Torvalds Cc: linux-mm@kvack.org, linux-hardening@vger.kernel.org, Kees Cook , Christopher Bazley , shadow <~hallyn/shadow@lists.sr.ht>, linux-kernel@vger.kernel.org, Andrew Morton , kasan-dev@googlegroups.com, Dmitry Vyukov , Alexander Potapenko , Marco Elver , Christoph Lameter , David Rientjes , Vlastimil Babka , Roman Gushchin , Harry Yoo , Andrew Clayton , Rasmus Villemoes , Michal Hocko , Al Viro , Martin Uecker , Sam James , Andrew Pinski Subject: Re: [RFC v5 6/7] sprintf: Add [v]sprintf_array() References: <04c1e026a67f1609167e834471d0f2fe977d9cb0.1752182685.git.alx@kernel.org> MIME-Version: 1.0 In-Reply-To: Hi Linus, [I'll reply to both of your emails at once] On Thu, Jul 10, 2025 at 02:58:24PM -0700, Linus Torvalds wrote: > You took my suggestion, and then you messed it up. >=20 > Your version of sprintf_array() is broken. It evaluates 'a' twice. > Because unlike ARRAY_SIZE(), your broken ENDOF() macro evaluates the > argument. An array has no issue being evaluated twice (unless it's a VLA). On the other hand, I agree it's better to not do that in the first place. My bad for forgetting about it. Sorry. On Thu, Jul 10, 2025 at 03:08:29PM -0700, Linus Torvalds wrote: > If you want to return an error on truncation, do it right. Not by > returning NULL, but by actually returning an error. Okay. > For example, in the kernel, we finally fixed 'strcpy()'. After about a > million different versions of 'copy a string' where every single > version was complete garbage, we ended up with 'strscpy()'. Yeah, the > name isn't lovely, but the *use* of it is: I have implemented the same thing in shadow, called strtcpy() (T for truncation). (With the difference that we read the string twice, since we don't care about threads.) I also plan to propose standardization of that one in ISO C. > - it returns the length of the result for people who want it - which > is by far the most common thing people want Agree. > - it returns an actual honest-to-goodness error code if something > overflowed, instead of the absoilutely horrible "source length" of the > string that strlcpy() does and which is fundamentally broken (because > it requires that you walk *past* the end of the source, > Christ-on-a-stick what a broken interface) Agree. > - it can take an array as an argument (without the need for another > name - see my earlier argument about not making up new names by just > having generics) We can't make the same thing with sprintf() variants because they're variadic, so you can't count the number of arguments. And since the 'end' argument is of the same type as the formatted string, we can't do it with _Generic reliably either. > Now, it has nasty naming (exactly the kind of 'add random character' > naming that I was arguing against), and that comes from so many > different broken versions until we hit on something that works. >=20 > strncpy is horrible garbage. strlcpy is even worse. strscpy actually > works and so far hasn't caused issues (there's a 'pad' version for the > very rare situation where you want 'strncpy-like' padding, but it > still guarantees NUL-termination, and still has a good return value). Agree. > Let's agree to *not* make horrible garbage when making up new versions > of sprintf. Agree. I indeed introduced the mistake accidentally in v4, after you complained of having too many functions, as I was introducing not one but two APIs: seprintf() and stprintf(), where seprintf() is what now we're calling sprintf_end(), and stprintf() we could call it sprintf_trunc(). So I did the mistake by trying to reduce the number of functions to just one, which is wrong. So, maybe I should go back to those functions, and just give them good names. What do you think of the following? #define sprintf_array(a, ...) sprintf_trunc(a, ARRAY_SIZE(a), __VA_ARGS__) #define vsprintf_array(a, ap) vsprintf_trunc(a, ARRAY_SIZE(a), ap) char *sprintf_end(char *p, const char end[0], const char *fmt, ...); char *vsprintf_end(char *p, const char end[0], const char *fmt, va_list ar= gs); int sprintf_trunc(char *buf, size_t size, const char *fmt, ...); int vsprintf_trunc(char *buf, size_t size, const char *fmt, va_list args); char *sprintf_end(char *p, const char end[0], const char *fmt, ...) { va_list args; va_start(args, fmt); p =3D vseprintf(p, end, fmt, args); va_end(args); return p; } char *vsprintf_end(char *p, const char end[0], const char *fmt, va_list ar= gs) { int len; if (unlikely(p =3D=3D NULL)) return NULL; len =3D vsprintf_trunc(p, end - p, fmt, args); if (unlikely(len < 0)) return NULL; return p + len; } int sprintf_trunc(char *buf, size_t size, const char *fmt, ...) { va_list args; int len; va_start(args, fmt); len =3D vstprintf(buf, size, fmt, args); va_end(args); return len; } int vsprintf_trunc(char *buf, size_t size, const char *fmt, va_list args) { int len; if (WARN_ON_ONCE(size =3D=3D 0 || size > INT_MAX)) return -EOVERFLOW; len =3D vsnprintf(buf, size, fmt, args); if (unlikely(len >=3D size)) return -E2BIG; return len; } sprintf_trunc() is like strscpy(), but with a formatted string. It could replace uses of s[c]nprintf() where there's a single call (no chained calls). sprintf_array() is like the 2-argument version of strscpy(). It could replace s[c]nprintf() calls where there's no chained calls, where the input is an array. sprintf_end() would replace the chained calls. Does this sound good to you? Cheers, Alex --=20 --lpnpaylljl22ydn2 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEES7Jt9u9GbmlWADAi64mZXMKQwqkFAmhwS38ACgkQ64mZXMKQ wqmhJhAAhZBNcIE/LkNJtDs9GNCCyYFQN+O55h5xwKBvOeNPeOX9QO202kKaYgsO +BNzl6ccOtttWGx1ReDyi4BrB78LZGtm17mfXSb+kDpeThSMOc4uBdVepQ3CpXwg p4fdLPwNMWp3kRyN0Y4t8+w4mejmpSKQtwoY/Es/IKp6h8ol+ivkM0V46NviK//I fqvkaLIeMoiM2fks1mvdELYGBdTtSTjI3iFd5gP8Gk+oxIS6csyjE1MCQbUBcAp1 VNaVVTRNstB34zYgQ6LhL2TzZySl7h1QK4Vd1yN8h8gRSg0TM3U3dWQ0ThcvjnDo cmoo8L3vj+Ya/hirwJ4h3MR0mSRKgDqvFSXC+p1/tI3xZCZZIFuuALQ2OLIl9gD2 yibSSV6NCBLueGs/UrUIT0Z7d/adiroKW9CRmsMdmLQSsIUDRNlARo2vndL9wU7S wjBHqh/feWZ9R/1DNQfPgOuqMaqGBqm8wh2eyp828bIgAu+YV75apRZ1Q5kWJTwx IydZHSnOViZbfo7sDxBG6s6APp2eJJN7+RZpL1doZctkneboKN2L7EYg2ZJErmgO oYOCbbyGkRqWkedbQ0zOJL7tanUA0zT9OPLABVV/hY6QngajyUeix4pP+ve76aJH fggtgH9SFW1uhmA7dCnBF1SABfPMrgFB+71kzC6wI+BBgGleLKs= =hhWT -----END PGP SIGNATURE----- --lpnpaylljl22ydn2--