From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.3 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,NICE_REPLY_A, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28031C43460 for ; Fri, 21 May 2021 12:54:01 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 94DA160FEE for ; Fri, 21 May 2021 12:53:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 94DA160FEE Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=prevas.dk Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id DE20482D56; Fri, 21 May 2021 14:53:56 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=prevas.dk Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=prevas.dk header.i=@prevas.dk header.b="mQtEh96F"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id D03AB82E1A; Fri, 21 May 2021 14:53:54 +0200 (CEST) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-ve1eur03on0712.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe09::712]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 9178A81CDE for ; Fri, 21 May 2021 14:53:51 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=prevas.dk Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=rasmus.villemoes@prevas.dk ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=bDyvrl7hF3Bkw7PCus+E62j4f4yBmKIt2/1VWwhTdZAK9phcccnOv+BQx270rYnLqO+Eu8Fz0vn/O74Gzs1YTjbrYH+Wvjg3SssBnQiraxuY3erKN0lEf6uffpga+VPgbH2SEhS9jbgyrkME3AbOCD0N7rEZQ3yamCavn9vonqjXKBQ6JVeRH8YPZ0/xXfs0Dda6oJIoHYVnSuz2VNIPzHx6qyVshKzcF4F/vKD8JE8e2bkdd3vasejxsHZueiPdJqD7y/wBKdJ9LxN9MY2uHR+kaac7UfNTUlHnaL1B2UIRhPJja/Q6Kf9vzChQSqbhtI7W8728PjUV3Eq5vM/3WA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1sUySFHCDnfSJ/Uee0tY4apS1J2UMQhwLJ71Zpq2dA4=; b=XI8TnrLv0RCxv9oMI5N/7bO6Vfnb+IaZuklJUltC8cbxI0Kk9tgo+4b99sEzq6/ezYajCF8s464ONyW9Va14wRPDzkogprH8hC+bKhruF9AsjM1tQamVzKE+ShEC+OdQbWPGWtY3SkRp9fxiZxgQ1bk7iTTahRWOrzLymz6aEWN5QRAzSUqh/fDj/Y7kGnzyuKMhZMxuZyeXPhh16Ky16WQ62Tlgd4/3OxnNXaODxiIYzEG4z/e5GDNvioU4s6YnmLrX4662G5cQxJq2JMTQNhaKPNalUE86k11eA8NI/939pCm71SZLl/s4EXcK+jU1nP63IbFZ2+q6o1CAjpkTJw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=prevas.dk; dmarc=pass action=none header.from=prevas.dk; dkim=pass header.d=prevas.dk; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=prevas.dk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1sUySFHCDnfSJ/Uee0tY4apS1J2UMQhwLJ71Zpq2dA4=; b=mQtEh96Fybxno5JofC7HnrMGvU5YQsVT2SqRZP1RLJrwkNBtVdoMgFNHVxAbm0G/wgdrZfgcEvFYmbI1q43ZL+cxTmsC451sM/RfU7QAcr3wzkHUNzgC+DxqnY6cSB5RISR9juFh3T+2rdPY8wJLIZ2MQWnQFc13lJqtKsjduv0= Authentication-Results: konsulko.com; dkim=none (message not signed) header.d=none;konsulko.com; dmarc=none action=none header.from=prevas.dk; Received: from AM0PR10MB1874.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:3f::10) by AM9PR10MB4838.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:415::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4150.23; Fri, 21 May 2021 12:53:50 +0000 Received: from AM0PR10MB1874.EURPRD10.PROD.OUTLOOK.COM ([fe80::888d:190b:b3b5:1ad2]) by AM0PR10MB1874.EURPRD10.PROD.OUTLOOK.COM ([fe80::888d:190b:b3b5:1ad2%3]) with mapi id 15.20.4129.028; Fri, 21 May 2021 12:53:50 +0000 Subject: Re: [PATCH 1/5] lib/vsprintf.c: make sure vsnprintf() never returns a negative value To: Simon Glass Cc: U-Boot Mailing List , Heinrich Schuchardt , Tom Rini References: <20210520100528.322846-1-rasmus.villemoes@prevas.dk> <20210520100528.322846-2-rasmus.villemoes@prevas.dk> From: Rasmus Villemoes Message-ID: Date: Fri, 21 May 2021 14:53:48 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.8.1 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [80.208.71.248] X-ClientProxiedBy: AM5PR0601CA0027.eurprd06.prod.outlook.com (2603:10a6:203:68::13) To AM0PR10MB1874.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:3f::10) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [192.168.1.149] (80.208.71.248) by AM5PR0601CA0027.eurprd06.prod.outlook.com (2603:10a6:203:68::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4150.23 via Frontend Transport; Fri, 21 May 2021 12:53:49 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 13901052-21df-431b-f0ea-08d91c577aff X-MS-TrafficTypeDiagnostic: AM9PR10MB4838: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: g2prLCKeoj6Dk15+GEiu2ABpApmcnQyyQZvH6BMOUiuQJSlXi0IS26rw+xFpXymLX2DjDg1rcNZikpw/XDETTIZ+d8FWTx003i/XxbbW7lV/ExmcqnLjjRrXtpLB/BvEWRrSLT3GxwnDFGcxPiyQxk52CZDbsTdbL7hcegKeU6hXX5/QUkhNs4nfxhpUm2IIVQjSBBjhyx1EQwIDyvMD4EFW1ensincV0UUIyFzc5Kg7HC7i8GVmJmnYJ2xNbB77/XMdx9TFg2OO/niaWDG8ENSsQ868kXp+F002IPyA2LcgpYHAOLvLSgkFfzZ5QliYV3+ClCOBlYv+6Fm+r5esO1PpGW0ApEZiXtT/gB733zo7j53UiX5LbDvfVEl8GkuFzNAJ9OSpeElAeCTZz+QyO15zF03qFLNWAP4KFYuYlOpNXDmErLSnp0tONaLJyfV9WghzBP5Q4egGjwkjeS3jePxIpUD0IFsir/uADwruR/3K9njfJNlVe9yLy2EYzclfeeHoqBMYJupN6NLICSUu24xx9u2Vihjo8P9W4PAIo7AVfj8Oewc7D8LdSNtyxsKq5SRFYivMoa5sRpEbg92L4Vqb1CnrSoyXmfHIqtRodhmpJCZMVN9vyhsMiObKQMW2V6z3O304ncphZovXCk0tjgAZRmTg3q5DOfYSn98ISwqlKSZ2aj+QNbgmBIsWIpYEbbijMGyoK/k9e9YQnjDwC/FJFRtIpZ7eMeXMhI34+6I= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB1874.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(376002)(346002)(396003)(366004)(39840400004)(136003)(66476007)(66556008)(66946007)(8936002)(4326008)(8976002)(26005)(83380400001)(5660300002)(2906002)(86362001)(31696002)(8676002)(52116002)(44832011)(6486002)(6916009)(316002)(478600001)(54906003)(2616005)(31686004)(38100700002)(36756003)(956004)(186003)(38350700002)(16576012)(16526019)(45980500001)(43740500002); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData: =?utf-8?B?VldRdG53amZnMUJmaFpYS1JOSnA5ekdVUUo5NFJsd1dNcW8ycDRvY3htbk5q?= =?utf-8?B?eDE5dU5Vc09HWU5hL2FlNGJRQVc5Mk5MTXpQNlRTTitTd2V6ZmRJWUJ6TWZN?= =?utf-8?B?WWxpYlQxaTNBK1ZqYkg2Q2ZUdWI0RE5WZjczSENXeVRtNkVvcGM1cEhUNkly?= =?utf-8?B?cElzbWJ1S2lLYlcwcWZueUJwaCtNMEtIQUUrNFV5dVNVbmVwSnBiZ01RblIz?= =?utf-8?B?eW9YMjJsNVFFZ1NMUXZIWndIOEFmeHZ0enRacVprVU5vZlFFM1FHbUswazdM?= =?utf-8?B?UW9yb0FsSmZhOW1CQi8yZlV5U1U4QVZIc0dzVlllOWlFVjVpUE1aYnNhbW4v?= =?utf-8?B?c2p1SjJ6TSt5aGQxQTRVNEpwN2REK1h5aElCTmFVOW5UdDRVTTM0QjJKZWU0?= =?utf-8?B?Nm5WQ2szM1FhQzRUWG1nbjhON2M2MHdMbFdFbUJyNDNURkdtMlduQ3VnUGJa?= =?utf-8?B?eXpwamhUbUMvN3hXMllmQ3dmbGVFU2JueVlTeGJPQjVxazlnS1NRUXprM005?= =?utf-8?B?T0lJT2NCL1hzQ3o1SXBjRkI4WG9VUVl4MGlQUEtySVNONVQ2czk5TW9MWWEz?= =?utf-8?B?b0pHeFlPVVFWTFozbFZKY1VLT3hrZ2xrdTNDaFExOTYyTEFnenQ0VUc3Nlli?= =?utf-8?B?ekhEZzVUVmg1NFFwYWVqUzJ6UkMyQ3pjRDh1ZTJRLy9VaVVJeWdKSEU0SnNz?= =?utf-8?B?TEtKaG5mV0Mrb2YrQ3F2SXNNc3BZRjBaMndCdUJ3VWJ6ZXdhYmhCZkdZODhk?= =?utf-8?B?NE1ocmtjSm1JaGxaSzlJbUUyeTNPUWlnSW8rK2p0aXdtQitDUUJEM3RFNDlH?= =?utf-8?B?RWJLNUN6RWM4RWtHYjh3SDhzNFpDalJGTlNkNEtjMEtvYzdCUWtuU3lwdnBB?= =?utf-8?B?NVQ4KzJieWJ0YjM2Mi9SNG1XdVYvbGt4Q2hjSW9rVHdORWxpRzAvLzk0dHpH?= =?utf-8?B?YWZZTUdvYk9jcWtkekpweVBBM3NDTCtZeDNvLzhjeitsR2xPZkU1UFdlQTc0?= =?utf-8?B?c2h6cEJCTkxZRTJuK3NvNHdhVlF1Y1N2SXJ0VmJkWlFpRVVIQ1BPTmFEcUpm?= =?utf-8?B?SU8wMnlPQ2NVVzBxb29KVHVnSkpGczZYSGVhZGhLSFM3SUxaT0pzU3d5REJ2?= =?utf-8?B?MHNPNEs5Y2xqU3JrRnV0MkVmK0pwK1Z2Ri9aSCtLbGlnODdhWEN0Mlcza2pW?= =?utf-8?B?QWxydVVXR1RJOUtKbGRpazVGbGdYaHhUSmtNaVVmem5kZ2hLbFJTVnlFWnRT?= =?utf-8?B?MVQ0NHFLZ3FaZHdKWUpCc2lxQmdMelkrS1dEN0hEK0pNWFpNVENsZVR1NU5P?= =?utf-8?B?UVAyUFp5YktTK1dCRXdzNlZ0Nk40WldNaVROVkNObndmaHFhL05IU1c0YTc5?= =?utf-8?B?eEJrSVlBOS9CaFQrVFYxcnZUcm5vOHdyV0dRRVQ5VWNBaTgySjNrMUl2SlEy?= =?utf-8?B?OGptT1dRc2tyZ0VvSUxPOGgrVklZUVozc3RGRTFWMnZhVDB6WUhTVTNhNDlk?= =?utf-8?B?bTI3YkZMSU1oOENQZGZOdGZnSTUrK3ltMTc5alVKL2NQV25NdkkxZzlwam92?= =?utf-8?B?QzhtbU0xNHZLajB5T2l6OE5wOW9TUHRwQ0xmZ0E4VDI2LzhiVGdsMnNkeUxh?= =?utf-8?B?MXJEeFVpelBRVENmT0dHbWNHV0lGaW9ydEZVcVkxaEFCZHpYQ2N0WWFYWDVL?= =?utf-8?B?S1RqN0JjbGR3SXNNM3J6M05TTW9KdHBhdmRwRzF5WDlrZHRlUjAwT3g4ajRM?= =?utf-8?Q?mNPERCpHrRM6QrQceq7Gj0V5KthAuDUgUG9A8YA?= X-OriginatorOrg: prevas.dk X-MS-Exchange-CrossTenant-Network-Message-Id: 13901052-21df-431b-f0ea-08d91c577aff X-MS-Exchange-CrossTenant-AuthSource: AM0PR10MB1874.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 May 2021 12:53:50.3110 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d350cf71-778d-4780-88f5-071a4cb1ed61 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UX453t2tihhdR/dV2UnZKg1Up5vopSoegwdQxDZYmD1d0b+FQqL9in6FAU4lsT42Xw1L+J8xdjE46FDffMVQTNAUcT5qsT8fZLewG5VSqD4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR10MB4838 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.4 at phobos.denx.de X-Virus-Status: Clean On 20/05/2021 19.51, Simon Glass wrote: > Hi Rasmus, > > On Thu, 20 May 2021 at 04:05, Rasmus Villemoes > wrote: >> >> Most callers (or callers of callers, etc.) of vsnprintf() are not >> prepared for it to return a negative value. >> >> The only case where that can currently happen is %pD, and it's IMO >> more user-friendly to produce some output that clearly shows that some >> "impossible" thing happened instead of having the message completely >> ignored - or mishandled as for example log.c would currently do. >> >> Signed-off-by: Rasmus Villemoes >> --- >> lib/vsprintf.c | 10 +--------- >> 1 file changed, 1 insertion(+), 9 deletions(-) > > I think that is debatable. If we want the calling code to be fixed, > then it needs to get an error code back. Otherwise the error will be > apparent to the user but (perhaps) not ever debugged. But it is not the calling code that is at fault for the vsnprintf() implementation (1) being able to fail and (2) actually encountering an ENOMEM situation. There's _nothing_ the calling code can do about that. The calling code can be said to be responsible for not passing NULL pointers, but that case is actually handled gracefully in various places in the printf code (both for %pD, but also plain %s). > The definition of printf() allows for the possibility of a negative > return value. First, please distinguish printf() from vsnprintf(). The former (in the normal userspace version) obviously can fail for the obvious EIO, ENOSPC reasons. The latter is indeed allowed to fail per the posix spec, but from a QoI perspective, I'd say it's much better to have a guarantee _for our particular implementation_ that it does not fail (meaning: returns a negative result). There's simply too many direct and indirect users of vsnprintf() that assume the result is non-negative; if we do not provide that guarantee, the alternative is to play a whack-a-mole game and add tons of error-checking code (adding bloat to the image), with almost never any good way to handle it. Take that log_info(" ... %pD") as an example. Suppose we "fix" log.c so that it ignores the message if vsnprintf (or vscnprintf, whatever) returns a negative result, just as print() currently does [which is the other thing that log_info could end up being handled by]. That means nothing gets printed on the console, and nobody gets told about the ENOMEM. In contrast, with this patch, we get Booting <%pD:ENOMEM> printed on the console, so at least _some_ part of the message gets out, and it's apparent that something odd happened. Of course, all of that is in the entirely unlikely sitation where the (efi) allocation would actually fail. If we don't want that <%pD:ENOMEM> thing, I'd still argue that we should ensure vsnprintf returns non-negative; e.g. by changing the "return PTR_ERR()" to a "goto out", i.e. simply stop the processing of the format string at the %pD which failed, but still go through the epilogue that ensures the resulting string becomes nul-terminated (another reasonable assumption made by tons of callers), and return how much got printed till then. Rasmus