Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value

[Sean Anderson <sean.anderson@seco.com>]

On 5/21/21 10:15 AM, Heinrich Schuchardt wrote:
 > On 21.05.21 14:53, Rasmus Villemoes wrote:
 >> On 20/05/2021 19.51, Simon Glass wrote:
 >>> Hi Rasmus,
 >>>
 >>> On Thu, 20 May 2021 at 04:05, Rasmus Villemoes
 >>> <rasmus.villemoes@prevas.dk> wrote:
 >>>>
 >>>> Most callers (or callers of callers, etc.) of vsnprintf() are not
 >>>> prepared for it to return a negative value.
 >>>>
 >>>> The only case where that can currently happen is %pD, and it's IMO
 >>>> more user-friendly to produce some output that clearly shows that some
 >>>> "impossible" thing happened instead of having the message completely
 >>>> ignored - or mishandled as for example log.c would currently do.
 >>>>
 >>>> Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
 >>>> ---
 >>>>   lib/vsprintf.c | 10 +---------
 >>>>   1 file changed, 1 insertion(+), 9 deletions(-)
 >>>
 >>> I think that is debatable. If we want the calling code to be fixed,
 >>> then it needs to get an error code back. Otherwise the error will be
 >>> apparent to the user but (perhaps) not ever debugged.
 >>
 >> But it is not the calling code that is at fault for the vsnprintf()
 >> implementation (1) being able to fail and (2) actually encountering an
 >> ENOMEM situation. There's _nothing_ the calling code can do about that.
 >
 > include/vsnprintf.h states:
 >
 > "This function follows C99 vsnprintf, but has some extensions:".
 >
 > The C99 spec says:
 >
 > "The vsnprintf function returns the number of characters that would have
 > been written had n been sufficiently large, not counting  the
 > terminating  null  character, or a negative value if an encoding error
 > occurred."

But is this an encoding error? And of course, the most common use of
this function which checks this return value will be

	n = vsnprintf(NULL, 0, fmt, ...);
	buf = malloc(n);
	if (!buf)
		/* out of memory */
	vsnprintf(buf, n, fmt, ...);

Which effectively already checks for ENOMEM. While it is
standard-compliant to return negative, it is also compliant to just use
a bogus value or to write nothing. There are many callers of
[v]s[c]nprintf which use the same pattern as the code above. If you
would like to fix all of them, go ahead. But I think this fix is more
efficient a cut.

--Sean

 >
 > It is obvious that the calling code needs to be fixed if it cannot
 > handle negative return values.
 >
 > So NAK to the patch.
 >
 > Best regards
 >
 > Heinrich
 >
 >>
 >> The calling code can be said to be responsible for not passing NULL
 >> pointers, but that case is actually handled gracefully in various places
 >> in the printf code (both for %pD, but also plain %s).
 >>
 >>> The definition of printf() allows for the possibility of a negative
 >>> return value.
 >>
 >> First, please distinguish printf() from vsnprintf(). The former (in the
 >> normal userspace version) obviously can fail for the obvious EIO, ENOSPC
 >> reasons. The latter is indeed allowed to fail per the posix spec, but
 >> from a QoI perspective, I'd say it's much better to have a guarantee
 >> _for our particular implementation_ that it does not fail (meaning:
 >> returns a negative result). There's simply too many direct and indirect
 >> users of vsnprintf() that assume the result is non-negative; if we do
 >> not provide that guarantee, the alternative is to play a whack-a-mole
 >> game and add tons of error-checking code (adding bloat to the image),
 >> with almost never any good way to handle it.
 >>
 >> Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so
 >> that it ignores the message if vsnprintf (or vscnprintf, whatever)
 >> returns a negative result, just as print() currently does [which is the
 >> other thing that log_info could end up being handled by]. That means
 >> nothing gets printed on the console, and nobody gets told about the
 >> ENOMEM. In contrast, with this patch, we get
 >>
 >>    Booting <%pD:ENOMEM>
 >>
 >> printed on the console, so at least _some_ part of the message gets out,
 >> and it's apparent that something odd happened. Of course, all of that is
 >> in the entirely unlikely sitation where the (efi) allocation would
 >> actually fail.
 >>
 >> If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should
 >> ensure vsnprintf returns non-negative; e.g. by changing the "return
 >> PTR_ERR()" to a "goto out", i.e. simply stop the processing of the
 >> format string at the %pD which failed, but still go through the epilogue
 >> that ensures the resulting string becomes nul-terminated (another
 >> reasonable assumption made by tons of callers), and return how much got
 >> printed till then.
 >>
 >> Rasmus
 >>
 >