[PATCH] bpf: add missing __printf attributes

[PATCH] bpf: add missing __printf attributes

[Arnd Bergmann]

From: Arnd Bergmann <arnd@arndb.de>

Some internal functions in bpf produce a warning when -Wsuggest-attribute=format
is passed to the compiler, e.g. in 'make W=1':

kernel/trace/bpf_trace.c: In function '____bpf_trace_printk':
kernel/trace/bpf_trace.c:377:9: error: function '____bpf_trace_printk' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format]
  377 |         ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt, data.bin_args);
      |         ^~~

The attribute here is useless since there are no callers from C code,
but it helps to shut up the output anyway so we can eventually turn
the warning option on by default.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 kernel/bpf/helpers.c     | 1 +
 kernel/bpf/stream.c      | 1 +
 kernel/trace/bpf_trace.c | 3 +++
 3 files changed, 5 insertions(+)

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index b54ec0e945aa..45d026fc4e8a 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -1046,6 +1046,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 	return err;
 }
 
+__printf(3, 0)
 BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
 	   const void *, args, u32, data_len)
 {
diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
index 24730df55e69..816fd7fba3d2 100644
--- a/kernel/bpf/stream.c
+++ b/kernel/bpf/stream.c
@@ -212,6 +212,7 @@ __bpf_kfunc_start_defs();
  * Avoid using enum bpf_stream_id so that kfunc users don't have to pull in the
  * enum in headers.
  */
+__printf(2, 0)
 __bpf_kfunc int bpf_stream_vprintk(int stream_id, const char *fmt__str, const void *args,
 				   u32 len__sz, struct bpf_prog_aux *aux)
 {
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index eadaef8592a3..2d3de71ab86a 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -359,6 +359,7 @@ static const struct bpf_func_proto bpf_probe_write_user_proto = {
 #define MAX_TRACE_PRINTK_VARARGS	3
 #define BPF_TRACE_PRINTK_SIZE		1024
 
+__printf(1, 0)
 BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
 	   u64, arg2, u64, arg3)
 {
@@ -412,6 +413,7 @@ const struct bpf_func_proto *bpf_get_trace_printk_proto(void)
 	return &bpf_trace_printk_proto;
 }
 
+__printf(1, 0)
 BPF_CALL_4(bpf_trace_vprintk, char *, fmt, u32, fmt_size, const void *, args,
 	   u32, data_len)
 {
@@ -455,6 +457,7 @@ const struct bpf_func_proto *bpf_get_trace_vprintk_proto(void)
 	return &bpf_trace_vprintk_proto;
 }
 
+__printf(2, 0)
 BPF_CALL_5(bpf_seq_printf, struct seq_file *, m, char *, fmt, u32, fmt_size,
 	   const void *, args, u32, data_len)
 {
-- 
2.39.5

Re: [PATCH] bpf: add missing __printf attributes

[Alexei Starovoitov]

On Tue, Feb 3, 2026 at 8:27 AM Arnd Bergmann <arnd@kernel.org> wrote:
>
> From: Arnd Bergmann <arnd@arndb.de>
>
> Some internal functions in bpf produce a warning when -Wsuggest-attribute=format
> is passed to the compiler, e.g. in 'make W=1':
>
> kernel/trace/bpf_trace.c: In function '____bpf_trace_printk':
> kernel/trace/bpf_trace.c:377:9: error: function '____bpf_trace_printk' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format]
>   377 |         ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt, data.bin_args);
>       |         ^~~
>
> The attribute here is useless since there are no callers from C code,
> but it helps to shut up the output anyway so we can eventually turn
> the warning option on by default.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>

This was discussed and it's incorrect.
Commit 7bf819aa992f ("vsnprintf: Mark binary printing functions with
__printf() attribute")
should be reverted instead.

pw-bot: cr

Re: [PATCH] bpf: add missing __printf attributes

[Arnd Bergmann]

On Tue, Feb 3, 2026, at 17:34, Alexei Starovoitov wrote:
> On Tue, Feb 3, 2026 at 8:27 AM Arnd Bergmann <arnd@kernel.org> wrote:
>>
>> From: Arnd Bergmann <arnd@arndb.de>
>>
>> Some internal functions in bpf produce a warning when -Wsuggest-attribute=format
>> is passed to the compiler, e.g. in 'make W=1':
>>
>> kernel/trace/bpf_trace.c: In function '____bpf_trace_printk':
>> kernel/trace/bpf_trace.c:377:9: error: function '____bpf_trace_printk' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format]
>>   377 |         ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt, data.bin_args);
>>       |         ^~~
>>
>> The attribute here is useless since there are no callers from C code,
>> but it helps to shut up the output anyway so we can eventually turn
>> the warning option on by default.
>>
>> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
>
> This was discussed and it's incorrect.

Do you have a reference to why it's incorrect?  It seems harmless
and gives me a clean kernel build in combination with a handful
of other fixes after enabling the option by default, but I assume
I'm missing something,

> Commit 7bf819aa992f ("vsnprintf: Mark binary printing functions with
> __printf() attribute") should be reverted instead.

Reverting that one would appear to introduce warnings elsewhere,
so that would not be a complete fix either.

      Arnd

Re: [PATCH] bpf: add missing __printf attributes

[Alexei Starovoitov]

On Tue, Feb 3, 2026 at 8:58 AM Arnd Bergmann <arnd@arndb.de> wrote:
>
> On Tue, Feb 3, 2026, at 17:34, Alexei Starovoitov wrote:
> > On Tue, Feb 3, 2026 at 8:27 AM Arnd Bergmann <arnd@kernel.org> wrote:
> >>
> >> From: Arnd Bergmann <arnd@arndb.de>
> >>
> >> Some internal functions in bpf produce a warning when -Wsuggest-attribute=format
> >> is passed to the compiler, e.g. in 'make W=1':
> >>
> >> kernel/trace/bpf_trace.c: In function '____bpf_trace_printk':
> >> kernel/trace/bpf_trace.c:377:9: error: function '____bpf_trace_printk' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format]
> >>   377 |         ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt, data.bin_args);
> >>       |         ^~~
> >>
> >> The attribute here is useless since there are no callers from C code,
> >> but it helps to shut up the output anyway so we can eventually turn
> >> the warning option on by default.
> >>
> >> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> >
> > This was discussed and it's incorrect.
>
> Do you have a reference to why it's incorrect?  It seems harmless
> and gives me a clean kernel build in combination with a handful
> of other fixes after enabling the option by default, but I assume
> I'm missing something,

because it's not a printf format. There are no varags here.
gnu_printf attribute takes two arguments:
format (archetype, string-index, first-to-check)
Also
"GCC requires a function with the 'format' attribute to be variadic"

> > Commit 7bf819aa992f ("vsnprintf: Mark binary printing functions with
> > __printf() attribute") should be reverted instead.
>
> Reverting that one would appear to introduce warnings elsewhere,
> so that would not be a complete fix either.

Somebody needs to root cause it and fix it properly.
Adding more incorrect annotation is not a solution.

Re: [PATCH] bpf: add missing __printf attributes

[Arnd Bergmann]

On Tue, Feb 3, 2026, at 18:24, Alexei Starovoitov wrote:
> On Tue, Feb 3, 2026 at 8:58 AM Arnd Bergmann <arnd@arndb.de> wrote:
>> On Tue, Feb 3, 2026, at 17:34, Alexei Starovoitov wrote:
>> > On Tue, Feb 3, 2026 at 8:27 AM Arnd Bergmann <arnd@kernel.org> wrote:
>> >>
>> >> From: Arnd Bergmann <arnd@arndb.de>
>> >>
>> >> Some internal functions in bpf produce a warning when -Wsuggest-attribute=format
>> >> is passed to the compiler, e.g. in 'make W=1':
>> >>
>> >> kernel/trace/bpf_trace.c: In function '____bpf_trace_printk':
>> >> kernel/trace/bpf_trace.c:377:9: error: function '____bpf_trace_printk' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format]
>> >>   377 |         ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt, data.bin_args);
>> >>       |         ^~~
>> >>
>> >> The attribute here is useless since there are no callers from C code,
>> >> but it helps to shut up the output anyway so we can eventually turn
>> >> the warning option on by default.
>> >>
>> >> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
>> >
>> > This was discussed and it's incorrect.
>>
>> Do you have a reference to why it's incorrect?  It seems harmless
>> and gives me a clean kernel build in combination with a handful
>> of other fixes after enabling the option by default, but I assume
>> I'm missing something,
>
> because it's not a printf format. There are no varags here.
> gnu_printf attribute takes two arguments:
> format (archetype, string-index, first-to-check)
> Also
> "GCC requires a function with the 'format' attribute to be variadic"

My impression was that at least vbin_printf() falls into the
same category as vprintf(), which is explictly mentioned in the
gcc documentation:

  For functions where the arguments are not available to be checked
  (such as 'vprintf'), specify the third parameter as zero.

I also see the comment about bstr_printf() mention that it
uses a vsnprintf() compatible format, which would indicate that
marking the format argument isn't wrong, though I agree it is
not actually useful if there are no callers that pass a string
literal.

>> > Commit 7bf819aa992f ("vsnprintf: Mark binary printing functions with
>> > __printf() attribute") should be reverted instead.
>>
>> Reverting that one would appear to introduce warnings elsewhere,
>> so that would not be a complete fix either.
>
> Somebody needs to root cause it and fix it properly.
> Adding more incorrect annotation is not a solution.

I've tried reverting it here now, will see what I can come up
with. We can probably use the same trick that I used "[PATCH]
[v2] tracing: move __printf() attribute on __ftrace_vbprintk()",
annotate only the definition but not the declaration so the
format string warning doesn't propagate to the callers.

      Arnd

Re: [PATCH] bpf: add missing __printf attributes

[Alexei Starovoitov]

On Tue, Feb 3, 2026 at 9:44 AM Arnd Bergmann <arnd@arndb.de> wrote:
>
> On Tue, Feb 3, 2026, at 18:24, Alexei Starovoitov wrote:
> > On Tue, Feb 3, 2026 at 8:58 AM Arnd Bergmann <arnd@arndb.de> wrote:
> >> On Tue, Feb 3, 2026, at 17:34, Alexei Starovoitov wrote:
> >> > On Tue, Feb 3, 2026 at 8:27 AM Arnd Bergmann <arnd@kernel.org> wrote:
> >> >>
> >> >> From: Arnd Bergmann <arnd@arndb.de>
> >> >>
> >> >> Some internal functions in bpf produce a warning when -Wsuggest-attribute=format
> >> >> is passed to the compiler, e.g. in 'make W=1':
> >> >>
> >> >> kernel/trace/bpf_trace.c: In function '____bpf_trace_printk':
> >> >> kernel/trace/bpf_trace.c:377:9: error: function '____bpf_trace_printk' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format]
> >> >>   377 |         ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt, data.bin_args);
> >> >>       |         ^~~
> >> >>
> >> >> The attribute here is useless since there are no callers from C code,
> >> >> but it helps to shut up the output anyway so we can eventually turn
> >> >> the warning option on by default.
> >> >>
> >> >> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> >> >
> >> > This was discussed and it's incorrect.
> >>
> >> Do you have a reference to why it's incorrect?  It seems harmless
> >> and gives me a clean kernel build in combination with a handful
> >> of other fixes after enabling the option by default, but I assume
> >> I'm missing something,
> >
> > because it's not a printf format. There are no varags here.
> > gnu_printf attribute takes two arguments:
> > format (archetype, string-index, first-to-check)
> > Also
> > "GCC requires a function with the 'format' attribute to be variadic"
>
> My impression was that at least vbin_printf() falls into the
> same category as vprintf(), which is explictly mentioned in the
> gcc documentation:
>
>   For functions where the arguments are not available to be checked
>   (such as 'vprintf'), specify the third parameter as zero.

Not quite. That comment in gcc doc is somewhat misleading.
zero means that it should be va_list.

Examples of correct annotations:

static __attribute__((unused, format(printf, 2, 0)))
int vfprintf(FILE *stream, const char *fmt, va_list args)


static __attribute__((unused, format(printf, 2, 3)))
int fprintf(FILE *stream, const char *fmt, ...)

A comment in gcc sources:
      /* Functions taking a va_list normally pass a non-literal format
         string.  These functions typically are declared with
         first_arg_num == 0, ...

Currently gcc doesn't go deep into va_list to validate them,
since they're likely not compile time constants,
but that's the meaning of zero.

> I also see the comment about bstr_printf() mention that it
> uses a vsnprintf() compatible format, which would indicate that
> marking the format argument isn't wrong, though I agree it is
> not actually useful if there are no callers that pass a string
> literal.

In general I don't think it's a good idea to add nop annotations
just to shut up over eager compiler warning.

Re: [PATCH] bpf: add missing __printf attributes

[Arnd Bergmann]

On Tue, Feb 3, 2026, at 19:11, Alexei Starovoitov wrote:
> On Tue, Feb 3, 2026 at 9:44 AM Arnd Bergmann <arnd@arndb.de> wrote:
>> On Tue, Feb 3, 2026, at 18:24, Alexei Starovoitov wrote:
>> I also see the comment about bstr_printf() mention that it
>> uses a vsnprintf() compatible format, which would indicate that
>> marking the format argument isn't wrong, though I agree it is
>> not actually useful if there are no callers that pass a string
>> literal.
>
> In general I don't think it's a good idea to add nop annotations
> just to shut up over eager compiler warning.

I've tried removing these three below, which now gives me
a clean build with -Wsuggest-attribute=format, after the
other three patches I posted for unrelated code.

     Arnd

diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
index d6ebf0596510..2fb266ea69fa 100644
--- a/include/linux/seq_file.h
+++ b/include/linux/seq_file.h
@@ -181,7 +181,6 @@ int seq_open_private(struct file *, const struct seq_operations *, int);
 int seq_release_private(struct inode *, struct file *);
 
 #ifdef CONFIG_BINARY_PRINTF
-__printf(2, 0)
 void seq_bprintf(struct seq_file *m, const char *f, const u32 *binary);
 #endif
 
diff --git a/include/linux/string.h b/include/linux/string.h
index 1b564c36d721..b850bd91b3d8 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -336,8 +336,8 @@ int __sysfs_match_string(const char * const *array, size_t n, const char *s);
 #define sysfs_match_string(_a, _s) __sysfs_match_string(_a, ARRAY_SIZE(_a), _s)
 
 #ifdef CONFIG_BINARY_PRINTF
-__printf(3, 0) int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args);
-__printf(3, 0) int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf);
+int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args);
+int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf);
 #endif
 
 extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,

Re: [PATCH] bpf: add missing __printf attributes

[Alexei Starovoitov]

On Tue, Feb 3, 2026 at 3:21 PM Arnd Bergmann <arnd@arndb.de> wrote:
>
> On Tue, Feb 3, 2026, at 19:11, Alexei Starovoitov wrote:
> > On Tue, Feb 3, 2026 at 9:44 AM Arnd Bergmann <arnd@arndb.de> wrote:
> >> On Tue, Feb 3, 2026, at 18:24, Alexei Starovoitov wrote:
> >> I also see the comment about bstr_printf() mention that it
> >> uses a vsnprintf() compatible format, which would indicate that
> >> marking the format argument isn't wrong, though I agree it is
> >> not actually useful if there are no callers that pass a string
> >> literal.
> >
> > In general I don't think it's a good idea to add nop annotations
> > just to shut up over eager compiler warning.
>
> I've tried removing these three below, which now gives me
> a clean build with -Wsuggest-attribute=format, after the
> other three patches I posted for unrelated code.

Nice. lgtm. Ack.

>      Arnd
>
> diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
> index d6ebf0596510..2fb266ea69fa 100644
> --- a/include/linux/seq_file.h
> +++ b/include/linux/seq_file.h
> @@ -181,7 +181,6 @@ int seq_open_private(struct file *, const struct seq_operations *, int);
>  int seq_release_private(struct inode *, struct file *);
>
>  #ifdef CONFIG_BINARY_PRINTF
> -__printf(2, 0)
>  void seq_bprintf(struct seq_file *m, const char *f, const u32 *binary);
>  #endif
>
> diff --git a/include/linux/string.h b/include/linux/string.h
> index 1b564c36d721..b850bd91b3d8 100644
> --- a/include/linux/string.h
> +++ b/include/linux/string.h
> @@ -336,8 +336,8 @@ int __sysfs_match_string(const char * const *array, size_t n, const char *s);
>  #define sysfs_match_string(_a, _s) __sysfs_match_string(_a, ARRAY_SIZE(_a), _s)
>
>  #ifdef CONFIG_BINARY_PRINTF
> -__printf(3, 0) int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args);
> -__printf(3, 0) int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf);
> +int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args);
> +int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf);
>  #endif
>
>  extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,