* [PATCH] lib/vsprintf: Fix to check field_width and precision
@ 2026-03-19 0:26 Masami Hiramatsu (Google)
2026-03-19 7:11 ` Andy Shevchenko
0 siblings, 1 reply; 3+ messages in thread
From: Masami Hiramatsu (Google) @ 2026-03-19 0:26 UTC (permalink / raw)
To: Petr Mladek, Steven Rostedt
Cc: Andy Shevchenko, Rasmus Villemoes, Sergey Senozhatsky,
Andrew Morton, linux-kernel
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Check the field_width and presition correctly. Previously it depends
on the bitfield conversion from int to check out-of-range error.
However, commit 938df695e98d ("vsprintf: associate the format state
with the format pointer") changed those fields to int.
We need to check the out-of-range correctly without bitfield
conversion.
Fixes: 938df695e98d ("vsprintf: associate the format state with the format pointer")
Reported-by: David Laight <david.laight.linux@gmail.com>
Closes: https://lore.kernel.org/all/20260318151250.40fef0ab@pumpkin/
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
lib/vsprintf.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 800b8ac49f53..054c9758118e 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -2803,7 +2803,8 @@ static void
set_field_width(struct printf_spec *spec, int width)
{
spec->field_width = width;
- if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) {
+ if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX ||
+ spec->field_width < -FIELD_WIDTH_MAX, "field width %d too large", width)) {
spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX);
}
}
@@ -2812,7 +2813,8 @@ static void
set_precision(struct printf_spec *spec, int prec)
{
spec->precision = prec;
- if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) {
+ if (WARN_ONCE(spec->precision > PRECISION_MAX || spec->precision < 0,
+ "precision %d too large", prec)) {
spec->precision = clamp(prec, 0, PRECISION_MAX);
}
}
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] lib/vsprintf: Fix to check field_width and precision
2026-03-19 0:26 [PATCH] lib/vsprintf: Fix to check field_width and precision Masami Hiramatsu (Google)
@ 2026-03-19 7:11 ` Andy Shevchenko
2026-03-20 2:20 ` Masami Hiramatsu
0 siblings, 1 reply; 3+ messages in thread
From: Andy Shevchenko @ 2026-03-19 7:11 UTC (permalink / raw)
To: Masami Hiramatsu (Google)
Cc: Petr Mladek, Steven Rostedt, Rasmus Villemoes, Sergey Senozhatsky,
Andrew Morton, linux-kernel
On Thu, Mar 19, 2026 at 09:26:59AM +0900, Masami Hiramatsu (Google) wrote:
> Check the field_width and presition correctly. Previously it depends
> on the bitfield conversion from int to check out-of-range error.
> However, commit 938df695e98d ("vsprintf: associate the format state
> with the format pointer") changed those fields to int.
> We need to check the out-of-range correctly without bitfield
> conversion.
...
> spec->field_width = width;
> - if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) {
> + if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX ||
> + spec->field_width < -FIELD_WIDTH_MAX, "field width %d too large", width)) {
Also use logical split as below:
if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX || spec->field_width < -FIELD_WIDTH_MAX,
"field width %d too large", width)) {
> spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX);
> }
> }
...
> spec->precision = prec;
> - if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) {
> + if (WARN_ONCE(spec->precision > PRECISION_MAX || spec->precision < 0,
> + "precision %d too large", prec)) {
> spec->precision = clamp(prec, 0, PRECISION_MAX);
> }
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] lib/vsprintf: Fix to check field_width and precision
2026-03-19 7:11 ` Andy Shevchenko
@ 2026-03-20 2:20 ` Masami Hiramatsu
0 siblings, 0 replies; 3+ messages in thread
From: Masami Hiramatsu @ 2026-03-20 2:20 UTC (permalink / raw)
To: Andy Shevchenko
Cc: Petr Mladek, Steven Rostedt, Rasmus Villemoes, Sergey Senozhatsky,
Andrew Morton, linux-kernel
On Thu, 19 Mar 2026 09:11:21 +0200
Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote:
> On Thu, Mar 19, 2026 at 09:26:59AM +0900, Masami Hiramatsu (Google) wrote:
>
> > Check the field_width and presition correctly. Previously it depends
> > on the bitfield conversion from int to check out-of-range error.
> > However, commit 938df695e98d ("vsprintf: associate the format state
> > with the format pointer") changed those fields to int.
> > We need to check the out-of-range correctly without bitfield
> > conversion.
>
> ...
>
> > spec->field_width = width;
> > - if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) {
> > + if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX ||
> > + spec->field_width < -FIELD_WIDTH_MAX, "field width %d too large", width)) {
>
> Also use logical split as below:
>
> if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX || spec->field_width < -FIELD_WIDTH_MAX,
> "field width %d too large", width)) {
OK, let me update it.
Thanks,
>
> > spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX);
> > }
> > }
>
> ...
>
> > spec->precision = prec;
> > - if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) {
> > + if (WARN_ONCE(spec->precision > PRECISION_MAX || spec->precision < 0,
> > + "precision %d too large", prec)) {
> > spec->precision = clamp(prec, 0, PRECISION_MAX);
> > }
>
> --
> With Best Regards,
> Andy Shevchenko
>
>
--
Masami Hiramatsu (Google) <mhiramat@kernel.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-20 2:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-19 0:26 [PATCH] lib/vsprintf: Fix to check field_width and precision Masami Hiramatsu (Google)
2026-03-19 7:11 ` Andy Shevchenko
2026-03-20 2:20 ` Masami Hiramatsu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox