[PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()

[PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()

[Arnd Bergmann]

From: Arnd Bergmann <arnd@arndb.de>

The sunrpc change to use trace_printk() for debugging caused
a new warning for every instance of dprintk() in some configurations,
when -Wformat-security is enabled:

fs/nfs/getroot.c: In function 'nfs_get_root':
fs/nfs/getroot.c:90:17: error: format not a string literal and no format arguments [-Werror=format-security]
   90 |                 nfs_errorf(fc, "NFS: Couldn't getattr on root");

I've been slowly chipping away at those warnings over time with the
intention of enabling them by default in the future. While I could not
figure out why this only happens for this one instance, I see that the
__trace_bprintk() function is always called with a local variable as
the format string, rather than a literal.

Remove the __printf(2,3) annotation on this function, as this is can
only be validated for literals. The format strings still get checked
because the underlying literal keeps getting passed into __trace_printk()
in the "else" branch, which is not taken but still evaluated for
compile-time warnings.

Fixes: ec7d8e68ef0e ("sunrpc: add a Kconfig option to redirect dfprintk() output to trace buffer")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 include/linux/trace_printk.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/linux/trace_printk.h b/include/linux/trace_printk.h
index bb5874097f24..2670ec7f4262 100644
--- a/include/linux/trace_printk.h
+++ b/include/linux/trace_printk.h
@@ -107,7 +107,6 @@ do {									\
 		__trace_printk(_THIS_IP_, fmt, ##args);			\
 } while (0)
 
-extern __printf(2, 3)
 int __trace_bprintk(unsigned long ip, const char *fmt, ...);
 
 extern __printf(2, 3)
-- 
2.39.5

Re: [PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()

[Jeff Layton]

On Mon, 2026-02-02 at 10:58 +0100, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@arndb.de>
> 
> The sunrpc change to use trace_printk() for debugging caused
> a new warning for every instance of dprintk() in some configurations,
> when -Wformat-security is enabled:
> 
> fs/nfs/getroot.c: In function 'nfs_get_root':
> fs/nfs/getroot.c:90:17: error: format not a string literal and no format arguments [-Werror=format-security]
>    90 |                 nfs_errorf(fc, "NFS: Couldn't getattr on root");
> 
> I've been slowly chipping away at those warnings over time with the
> intention of enabling them by default in the future. While I could not
> figure out why this only happens for this one instance, I see that the
> __trace_bprintk() function is always called with a local variable as
> the format string, rather than a literal.
> 
> Remove the __printf(2,3) annotation on this function, as this is can
> only be validated for literals. The format strings still get checked
> because the underlying literal keeps getting passed into __trace_printk()
> in the "else" branch, which is not taken but still evaluated for
> compile-time warnings.
> 
> Fixes: ec7d8e68ef0e ("sunrpc: add a Kconfig option to redirect dfprintk() output to trace buffer")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
>  include/linux/trace_printk.h | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/include/linux/trace_printk.h b/include/linux/trace_printk.h
> index bb5874097f24..2670ec7f4262 100644
> --- a/include/linux/trace_printk.h
> +++ b/include/linux/trace_printk.h
> @@ -107,7 +107,6 @@ do {									\
>  		__trace_printk(_THIS_IP_, fmt, ##args);			\
>  } while (0)
>  
> -extern __printf(2, 3)
>  int __trace_bprintk(unsigned long ip, const char *fmt, ...);
>  
>  extern __printf(2, 3)

Acked-by: Jeff Layton <jlayton@kernel.org>

Re: [PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()

[Andy Shevchenko]

On Mon, Feb 02, 2026 at 10:58:27AM +0100, Arnd Bergmann wrote:

> The sunrpc change to use trace_printk() for debugging caused
> a new warning for every instance of dprintk() in some configurations,
> when -Wformat-security is enabled:
> 
> fs/nfs/getroot.c: In function 'nfs_get_root':
> fs/nfs/getroot.c:90:17: error: format not a string literal and no format arguments [-Werror=format-security]
>    90 |                 nfs_errorf(fc, "NFS: Couldn't getattr on root");
> 
> I've been slowly chipping away at those warnings over time with the
> intention of enabling them by default in the future. While I could not
> figure out why this only happens for this one instance, I see that the
> __trace_bprintk() function is always called with a local variable as
> the format string, rather than a literal.
> 
> Remove the __printf(2,3) annotation on this function, as this is can
> only be validated for literals. The format strings still get checked
> because the underlying literal keeps getting passed into __trace_printk()
> in the "else" branch, which is not taken but still evaluated for
> compile-time warnings.

Yeah, it was discussed in the past that binary printf() should not be annotated
as we have BPF code that doesn't compile (with the default WERROR=y).

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()

[Steven Rostedt]

On Mon,  2 Feb 2026 10:58:27 +0100
Arnd Bergmann <arnd@kernel.org> wrote:

> From: Arnd Bergmann <arnd@arndb.de>
> 
> The sunrpc change to use trace_printk() for debugging caused
> a new warning for every instance of dprintk() in some configurations,
> when -Wformat-security is enabled:
> 
> fs/nfs/getroot.c: In function 'nfs_get_root':
> fs/nfs/getroot.c:90:17: error: format not a string literal and no format arguments [-Werror=format-security]
>    90 |                 nfs_errorf(fc, "NFS: Couldn't getattr on root");
> 
> I've been slowly chipping away at those warnings over time with the
> intention of enabling them by default in the future. While I could not
> figure out why this only happens for this one instance, I see that the
> __trace_bprintk() function is always called with a local variable as
> the format string, rather than a literal.
> 
> Remove the __printf(2,3) annotation on this function, as this is can
> only be validated for literals. The format strings still get checked
> because the underlying literal keeps getting passed into __trace_printk()
> in the "else" branch, which is not taken but still evaluated for
> compile-time warnings.
> 
> Fixes: ec7d8e68ef0e ("sunrpc: add a Kconfig option to redirect dfprintk() output to trace buffer")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>

-- Steve

> ---
>  include/linux/trace_printk.h | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/include/linux/trace_printk.h b/include/linux/trace_printk.h
> index bb5874097f24..2670ec7f4262 100644
> --- a/include/linux/trace_printk.h
> +++ b/include/linux/trace_printk.h
> @@ -107,7 +107,6 @@ do {									\
>  		__trace_printk(_THIS_IP_, fmt, ##args);			\
>  } while (0)
>  
> -extern __printf(2, 3)
>  int __trace_bprintk(unsigned long ip, const char *fmt, ...);
>  
>  extern __printf(2, 3)

Re: [PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()

[kernel test robot]

Hi Arnd,

kernel test robot noticed the following build warnings:

[auto build test WARNING on next-20260130]
[cannot apply to trace/for-next linus/master v6.19-rc8 v6.19-rc7 v6.19-rc6 v6.19-rc8]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Arnd-Bergmann/tracing-remove-__printf-attribute-on-__ftrace_vbprintk/20260202-180958
base:   next-20260130
patch link:    https://lore.kernel.org/r/20260202095834.1328352-1-arnd%40kernel.org
patch subject: [PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()
config: riscv-allmodconfig (https://download.01.org/0day-ci/archive/20260203/202602032036.FQK7gJvV-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9b8addffa70cee5b2acc5454712d9cf78ce45710)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260203/202602032036.FQK7gJvV-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602032036.FQK7gJvV-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> kernel/trace/trace_printk.c:212:34: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 3)' attribute to the declaration of '__trace_bprintk' [-Wmissing-format-attribute]
     212 |         ret = trace_vbprintk(ip, fmt, ap);
         |                                         ^
   include/linux/trace_printk.h:110:5: note: '__trace_bprintk' declared here
     110 | int __trace_bprintk(unsigned long ip, const char *fmt, ...);
         |     ^
   1 warning generated.


vim +212 kernel/trace/trace_printk.c

1ba28e02a18cbd kernel/trace/trace_bprintk.c Lai Jiangshan            2009-03-06  199  
48ead02030f849 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-12  200  int __trace_bprintk(unsigned long ip, const char *fmt, ...)
1427cdf0592368 kernel/trace/trace_bprintk.c Lai Jiangshan            2009-03-06  201  {
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  202  	int ret;
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  203  	va_list ap;
1427cdf0592368 kernel/trace/trace_bprintk.c Lai Jiangshan            2009-03-06  204  
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  205  	if (unlikely(!fmt))
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  206  		return 0;
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  207  
b9f9108cad3998 kernel/trace/trace_printk.c  Steven Rostedt (Red Hat  2015-09-29  208) 	if (!trace_printk_enabled)
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  209  		return 0;
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  210  
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  211  	va_start(ap, fmt);
40ce74f19c2807 kernel/trace/trace_printk.c  Steven Rostedt           2009-03-19 @212  	ret = trace_vbprintk(ip, fmt, ap);
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  213  	va_end(ap);
769b0441f438c4 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-06  214  	return ret;
1427cdf0592368 kernel/trace/trace_bprintk.c Lai Jiangshan            2009-03-06  215  }
48ead02030f849 kernel/trace/trace_printk.c  Frederic Weisbecker      2009-03-12  216  EXPORT_SYMBOL_GPL(__trace_bprintk);
1427cdf0592368 kernel/trace/trace_bprintk.c Lai Jiangshan            2009-03-06  217  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()

[Andy Shevchenko]

On Tue, Feb 03, 2026 at 08:12:57PM +0800, kernel test robot wrote:

> kernel test robot noticed the following build warnings:

Yeah, you need to go for the full stack of these calls and mark the bottom one
with __diag() to avoid these warnings. That's my understanding and what BPF people
required. Chasing this one-by-one would produce unneeded churn.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()

[Arnd Bergmann]

On Tue, Feb 3, 2026, at 15:58, Andy Shevchenko wrote:
> On Tue, Feb 03, 2026 at 08:12:57PM +0800, kernel test robot wrote:
>
>> kernel test robot noticed the following build warnings:
>
> Yeah, you need to go for the full stack of these calls and mark the 
> bottom one with __diag() to avoid these warnings. That's my understanding
> and what BPF people required. Chasing this one-by-one would produce
> unneeded churn.

From what I can tell, I can just move the printf attribute
to the __ftrace_vbprintk() definition to make this bit work.
I'll send an updated patch:

--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -197,6 +197,7 @@ struct notifier_block module_trace_bprintk_format_nb = {
        .notifier_call = module_trace_bprintk_format_notify,
 };
 
+__printf(2, 3)
 int __trace_bprintk(unsigned long ip, const char *fmt, ...)
 {
        int ret;

There are unrelated warnings for BPF that I managed to
shut up the same way, doing

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index b54ec0e945aa..45d026fc4e8a 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -1046,6 +1046,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
        return err;
 }
 
+__printf(3, 0)
 BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
           const void *, args, u32, data_len)
 {
diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
index 24730df55e69..816fd7fba3d2 100644
--- a/kernel/bpf/stream.c
+++ b/kernel/bpf/stream.c
@@ -212,6 +212,7 @@ __bpf_kfunc_start_defs();
  * Avoid using enum bpf_stream_id so that kfunc users don't have to pull in the
  * enum in headers.
  */
+__printf(2, 0)
 __bpf_kfunc int bpf_stream_vprintk(int stream_id, const char *fmt__str, const void *args,
                                   u32 len__sz, struct bpf_prog_aux *aux)
 {
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index eadaef8592a3..2d3de71ab86a 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -359,6 +359,7 @@ static const struct bpf_func_proto bpf_probe_write_user_proto = {
 #define MAX_TRACE_PRINTK_VARARGS       3
 #define BPF_TRACE_PRINTK_SIZE          1024
 
+__printf(1, 0)
 BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
           u64, arg2, u64, arg3)
 {
@@ -412,6 +413,7 @@ const struct bpf_func_proto *bpf_get_trace_printk_proto(void)
        return &bpf_trace_printk_proto;
 }
 
+__printf(1, 0)
 BPF_CALL_4(bpf_trace_vprintk, char *, fmt, u32, fmt_size, const void *, args,
           u32, data_len)
 {
@@ -455,6 +457,7 @@ const struct bpf_func_proto *bpf_get_trace_vprintk_proto(void)
        return &bpf_trace_vprintk_proto;
 }
 
+__printf(2, 0)
 BPF_CALL_5(bpf_seq_printf, struct seq_file *, m, char *, fmt, u32, fmt_size,
           const void *, args, u32, data_len)
 {

Since those functions have no callers, the annotation on the
print functions does nothing.

With those added, and a couple of drivers fixed to use the
correct printf attributes, the only remaining one I see is
in samples/trace_events/trace-events-sample.h:

In file included from /home/arnd/arm-soc/include/trace/define_trace.h:132,
                 from /home/arnd/arm-soc/samples/trace_events/trace-events-sample.h:640,
                 from /home/arnd/arm-soc/samples/trace_events/trace-events-sample.c:12:
/home/arnd/arm-soc/samples/trace_events/./trace-events-sample.h: In function 'trace_event_get_offsets_foo_bar':
/home/arnd/arm-soc/include/trace/stages/stage5_get_offsets.h:33:31: error: function 'trace_event_get_offsets_foo_bar' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format]
   33 |         { (void)sizeof(struct _test_no_array_##item *); }
      |                               ^~~~~~~~~~~~~~~
/home/arnd/arm-soc/include/trace/trace_events.h:285:9: note: in definition of macro 'DECLARE_EVENT_CLASS'
  285 |         tstruct;                                                        \
      |         ^~~~~~~
/home/arnd/arm-soc/include/trace/trace_events.h:43:30: note: in expansion of macro 'PARAMS'
   43 |                              PARAMS(tstruct),                  \
      |                              ^~~~~~
/home/arnd/arm-soc/samples/trace_events/./trace-events-sample.h:291:1: note: in expansion of macro 'TRACE_EVENT'
  291 | TRACE_EVENT(foo_bar,
      | ^~~~~~~~~~~
/home/arnd/arm-soc/samples/trace_events/./trace-events-sample.h:299:9: note: in expansion of macro 'TP_STRUCT__entry'
  299 |         TP_STRUCT__entry(
      |         ^~~~~~~~~~~~~~~~
/home/arnd/arm-soc/samples/trace_events/./trace-events-sample.h:301:17: note: in expansion of macro '__field'
  301 |                 __field(        int,    bar                     )
      |                 ^~~~~~~
/home/arnd/arm-soc/samples/trace_events/./trace-events-sample.h: In function 'do_trace_event_raw_event_foo_bar':

I don't think this is related, but I also don't see an obvious
workaround other than forcing the warning off around that
definition.

       Arnd

Re: [PATCH] tracing: remove __printf() attribute on __ftrace_vbprintk()

[Andy Shevchenko]

On Tue, Feb 03, 2026 at 04:56:03PM +0100, Arnd Bergmann wrote:
> On Tue, Feb 3, 2026, at 15:58, Andy Shevchenko wrote:
> > On Tue, Feb 03, 2026 at 08:12:57PM +0800, kernel test robot wrote:
> >
> >> kernel test robot noticed the following build warnings:
> >
> > Yeah, you need to go for the full stack of these calls and mark the 
> > bottom one with __diag() to avoid these warnings. That's my understanding
> > and what BPF people required. Chasing this one-by-one would produce
> > unneeded churn.
> 
> From what I can tell, I can just move the printf attribute
> to the __ftrace_vbprintk() definition to make this bit work.

Ah, that's cool!

...

> There are unrelated warnings for BPF that I managed to
> shut up the same way, doing

BPF rejected such an approach, see lore discussions in the past
(patches from me). Here some pointers (but not all of them):

20251208141618.2805983-1-andriy.shevchenko@linux.intel.com
202512090407.VxRO6xAS-lkp@intel.com
20251210131234.3185985-1-andriy.shevchenko@linux.intel.com
20251216122514.7ee70d5f@canb.auug.org.au
20251215202430.c35c2d29c4f9ff614d2ab534@linux-foundation.org

-- 
With Best Regards,
Andy Shevchenko