From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03640C83F1B for ; Fri, 11 Jul 2025 17:43:51 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9D4276B00A1; Fri, 11 Jul 2025 13:43:50 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 984356B00A3; Fri, 11 Jul 2025 13:43:50 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 874366B00A4; Fri, 11 Jul 2025 13:43:50 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 70DEE6B00A1 for ; Fri, 11 Jul 2025 13:43:50 -0400 (EDT) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 57F861DCED3 for ; Fri, 11 Jul 2025 17:43:49 +0000 (UTC) X-FDA: 83652706578.11.0712975 Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) by imf23.hostedemail.com (Postfix) with ESMTP id 50018140005 for ; Fri, 11 Jul 2025 17:43:47 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=ESWpLtxE; spf=pass (imf23.hostedemail.com: domain of david.laight.linux@gmail.com designates 209.85.221.45 as permitted sender) smtp.mailfrom=david.laight.linux@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1752255827; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=VknUmgzMCiBefIq6vhslDBLHtoemuumEdTr+qyL4BSs=; b=TLFdcrSY2IlcmOhAtLOLJmLtmXh4y7GcrgLSjUy7LL8wNu8IA6wY5NFPoDusVp5/gCU/Gh LqYQF833NUYTvMUSmWH3P1OUYYSwtwoswfsfEaF3MCHGiPki4UB3QziZoj4V0IXhFRm1lN xq1xa75VL0i7LywaMD3u9UiYjygQ0zQ= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=ESWpLtxE; spf=pass (imf23.hostedemail.com: domain of david.laight.linux@gmail.com designates 209.85.221.45 as permitted sender) smtp.mailfrom=david.laight.linux@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1752255827; a=rsa-sha256; cv=none; b=4/QF2zrdsbH+LyaVlnSRKDT1SRjLz14eJiFMqqstsBl0tCQXhn9PMiT3yG7yqPUBti2hNl DyzKVuyGNu9Qbfx4ApXZo9HPJiXm4Sueyk8RrIi1advaOSXB4lcctlyho0PJw/hlGbWSAH 8051w0vtGVoC1nfIYPNq1NsE1i2eTZE= Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-3a4e742dc97so2204119f8f.0 for ; Fri, 11 Jul 2025 10:43:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1752255825; x=1752860625; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=VknUmgzMCiBefIq6vhslDBLHtoemuumEdTr+qyL4BSs=; b=ESWpLtxEV2k2ZWoB5juu6JOJ3S/9p3u1rdooFmQTCk6l+dpK275giDiOuBZYcrCRWM mXpi3FTbiS4wZgZR5oo/Vud+3qJkO0VcU9pl+9xwu2lIu4rKnxk4Y6oKLpgBbzgvn+pF 4ny44a1ZUzXYD4eKgMrmbo/11Et55LTXoTSU1QLchp4zui1DE4YfK7kPejTdvVvPXY3a zL4uCg8wyPoMPVz9xHrxtcHhhdgHgVXrYo8/7l9O49j1xVaw/cfEqYz6pVHTxB4WXNX5 qqrkBNu88HRHGyMpeHcekdzMmgsNpBpsg1e3FHBjgfqSFA0V7a7qXWc2XY1WPRgLrOJN W/DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1752255825; x=1752860625; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=VknUmgzMCiBefIq6vhslDBLHtoemuumEdTr+qyL4BSs=; b=g1G8/omKzgYLkRvtOy3xXzhP3fvYE4geoEqz+Nzyq+hLRDGFf6ZENugYUOqEzW6Vxt eXijYBHjXaUSXJ3eTHJNMTctG6rjyi7lKTXMmmISCDAR2n2jryZ7S0u5l9+EizQwguk5 5wuJN3wDmvIJiCG5hC+Q54Q0eZE6ELFF7vmJjainotkiUu6DPR3GVp8BCnFNALtCvSeb RWeTsf8CCp04nFhGZXaM0zHbxnmSWwxZgAtlsXIxM862Jaz0Hnsi7SAb7AAfmKmKMij3 sbwLAS6oMXilMQ5zRmzVVQlk9AZga/jvG4PQfxmpk+n+MAt/PXHbjc33F2Wq1RMTKCFe lTaQ== X-Forwarded-Encrypted: i=1; AJvYcCVq4YoLaIEnbu1pVAYXhWOEnjyAxE1EH81jKuZHdzH8tuh+G6qC0SaW5EzMNRNpcKyLMrbgCIy++w==@kvack.org X-Gm-Message-State: AOJu0YwkTkQAS+DSCLsVWKN5/tfNV/ZWxUJUIs+7ZBilkFd18ySpbGLQ MbWwjzJyD6UMjokyN6KBNpWivuQpDc7xDIP5WobeQyFhn427j8V9OZQa X-Gm-Gg: ASbGnctLt3ViJcdQBgSUhRQXPWg7YaDgmim0rcWcInIdT9PD2I0mkEvSDQ+rU5who2e Jw7whQFzbdc+45O1Z0ErYvOU6b/6L055aumbSZGsTSOOXtyH3MUho3XIFGXcXfS5JUBDgW7PDfi CHpkTvPJPxzBV+DFaZvJiL6Zqtvq59A57dD3+GMJlFLu0YE+Wjj2I2TBw8EgjlMm8UBSOUxA3My Hw24V9nlChSTjj+jLJxdgalR88Igvk2hnPif7dGDdb/1wZZBEqhEZTsAdreyk4Bok1Q4PAaYghK O8oVeZuNtuK5zBEN8w5ObJ/IJUhto5O6mS7NSARxRELRegAHh10jSiaKftxQUPSKgn8mUKwTuOY GsCIK0K20teM7YisCzMJuIxRLyhTNCGU8JTJR/LWQhsKH6jYRnhrVNw== X-Google-Smtp-Source: AGHT+IF2FUJm50SIImAtnkLfjpZxfOQ0V8XNcp8oj0UXtEvNIKIo/bW01pizDxqtXrEQGSaKXvDafw== X-Received: by 2002:a05:6000:2f86:b0:3a0:b565:a2cb with SMTP id ffacd0b85a97d-3b5f1c67becmr3586044f8f.1.1752255825300; Fri, 11 Jul 2025 10:43:45 -0700 (PDT) Received: from pumpkin (host-92-21-58-28.as13285.net. [92.21.58.28]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3b5e8e1e1a5sm4954576f8f.74.2025.07.11.10.43.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 11 Jul 2025 10:43:45 -0700 (PDT) Date: Fri, 11 Jul 2025 18:43:43 +0100 From: David Laight To: Alejandro Colomar Cc: Linus Torvalds , linux-mm@kvack.org, linux-hardening@vger.kernel.org, Kees Cook , Christopher Bazley , shadow <~hallyn/shadow@lists.sr.ht>, linux-kernel@vger.kernel.org, Andrew Morton , kasan-dev@googlegroups.com, Dmitry Vyukov , Alexander Potapenko , Marco Elver , Christoph Lameter , David Rientjes , Vlastimil Babka , Roman Gushchin , Harry Yoo , Andrew Clayton , Rasmus Villemoes , Michal Hocko , Al Viro , Martin Uecker , Sam James , Andrew Pinski Subject: Re: [RFC v5 6/7] sprintf: Add [v]sprintf_array() Message-ID: <20250711184343.5eabd457@pumpkin> In-Reply-To: References: <04c1e026a67f1609167e834471d0f2fe977d9cb0.1752182685.git.alx@kernel.org> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Rspam-User: X-Rspamd-Queue-Id: 50018140005 X-Rspamd-Server: rspam02 X-Stat-Signature: gnti7opxbtbxiip91sdfpqcj7jp1aikc X-HE-Tag: 1752255827-787231 X-HE-Meta: U2FsdGVkX189wlYvnBP+Dk5aeTn2C2DkKwYpbdLGmNmZffkeZ86C7EQ7dRo3ngC4hgvYOdz+yhhMT2smTqRSjPJ0fZ/PoMTw1BjZ+sa4l7asfMnTPC7TQaurKxjcXzKMh8D0aYjXAwjbOvfArDxIOM8isCJ/szRuP9Cwbk+s2FKZgwx69wTPZW0JtXwE6Yn1tjNEUHM/59pZdlA4JpVGQ29d0AfLteiMW6NnsWke1/keH2M/wlYzOuMSfXAO5TWui8rlFKlxbxZEVlpYwE2CTtIWHzVr2hie6tDdDZWqKSNoPcEZH8l35KA8UgJB1R7mXvzOk8fz8mgVSW4PjVpBisbJYanYpRXUpTFZLQ/HZ3Z40VA8ACAyw3nB+oZkTxp+zvFIuB8Quz9+n1GY3j7Rhr3g24jK20mQEW2IAj18QWryfmbZSy42c2nEejvBMZXt7l0nYCXeztSyyNoTGp9fVuGcs1+RtR93u6Dj652vAOL7EtJx89pnh7E8ucIrArHdOD1GUUb4HezZkrtp9S5Y81LbM43RakpgBfjkdV9l5nC5VYd9FiHLmac2lmPE++/f7DlSrcuYo8I/WUbhY7xmPXnzL0GwQ5GP1ppmM43r1YzGAaxDduBP3YJ6V6ylthAt70sKR88oZFwHuRZDWnOwfKKKhwV5YcJ2v/MOXOK2OQexhtuUxD+/3+MOkUJp+RmGOJHRBOCyWRCJb9GU9b+QyBaGPv6+y+Jk0WLDzhiuK5l6N1f884ZqqaasGisON2ACbWsCxWVd9sPmUi3uKTpLEdVLPyGBBUqWIDKvFGFzwFzKvjQpklIAtRe46dbdZqGyJRrAlb0OKwlsauadXGhOl80oey5HFQr4/PKCrLLAMuwnHzrCdwyLi5q2BvpQLyLxHjCLjYYGJanK4gYP8tZtUIapFLpS8c9ZCRoYw3yZf9pIhjfTGq+Ltwmjq6kAg4MfBL76Phpm5OabgW76yps tWezhLX4 8+g2wcCISNfqcxPpDyhID+Ez0aIg+4IyGpQ4VXPGm9abr1bU6DfSzk4R9NDYfxC6CpT1gJOtuZD3D1ZaFLkE7AC0oblBzjotInQulDl3LCj/XppmpTTVXsYtMGoLPOr5qJ1FMd2HWeGGnjVrD1EJFyx+gAPNRTb0f90BU3vmfyJEbtetRnXSQ/wwqD3Seh8YWJayAt4AO2vedWVj1itoInyoGV6X23QSeo7yzY91DherKRL5BQuLqNCeCmYvMLwMkQ+YSJQquRfXleCk0h5p/diZ2XF0MUfJocDmck48Xwchv5yL3L0bDmNqr2rwQW0oUTpMjuMifMQUHbJny5W6MVmU/kgymGK7dLqbaiw6HGxhC4JIbgXFomOmnbpJQ+Ia47dghG+7AhpA3pi1g43UpP/MFvu0PrJqc8jRop8wYNoKTXnoMJ0jPPgpwcHEOKqsPwnV8AAci20SmGNqT0to/HFQTZ09CpohOFXVj7eySIrY7KVqubVPpIqvJD7oOANwpATrsLmD4jdyUiR4KMVAtVV97U2Lwbob0jwJiaujcalbt3fmEYtL8GezqL7oauGSPb0oc X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Fri, 11 Jul 2025 01:23:49 +0200 Alejandro Colomar wrote: > Hi Linus, > > [I'll reply to both of your emails at once] > > On Thu, Jul 10, 2025 at 02:58:24PM -0700, Linus Torvalds wrote: > > You took my suggestion, and then you messed it up. > > > > Your version of sprintf_array() is broken. It evaluates 'a' twice. > > Because unlike ARRAY_SIZE(), your broken ENDOF() macro evaluates the > > argument. > > An array has no issue being evaluated twice (unless it's a VLA). On the > other hand, I agree it's better to not do that in the first place. > My bad for forgetting about it. Sorry. Or a function that returns an array... David > > On Thu, Jul 10, 2025 at 03:08:29PM -0700, Linus Torvalds wrote: > > If you want to return an error on truncation, do it right. Not by > > returning NULL, but by actually returning an error. > > Okay. > > > For example, in the kernel, we finally fixed 'strcpy()'. After about a > > million different versions of 'copy a string' where every single > > version was complete garbage, we ended up with 'strscpy()'. Yeah, the > > name isn't lovely, but the *use* of it is: > > I have implemented the same thing in shadow, called strtcpy() (T for > truncation). (With the difference that we read the string twice, since > we don't care about threads.) > > I also plan to propose standardization of that one in ISO C. > > > - it returns the length of the result for people who want it - which > > is by far the most common thing people want > > Agree. > > > - it returns an actual honest-to-goodness error code if something > > overflowed, instead of the absoilutely horrible "source length" of the > > string that strlcpy() does and which is fundamentally broken (because > > it requires that you walk *past* the end of the source, > > Christ-on-a-stick what a broken interface) > > Agree. > > > - it can take an array as an argument (without the need for another > > name - see my earlier argument about not making up new names by just > > having generics) > > We can't make the same thing with sprintf() variants because they're > variadic, so you can't count the number of arguments. And since the > 'end' argument is of the same type as the formatted string, we can't > do it with _Generic reliably either. > > > Now, it has nasty naming (exactly the kind of 'add random character' > > naming that I was arguing against), and that comes from so many > > different broken versions until we hit on something that works. > > > > strncpy is horrible garbage. strlcpy is even worse. strscpy actually > > works and so far hasn't caused issues (there's a 'pad' version for the > > very rare situation where you want 'strncpy-like' padding, but it > > still guarantees NUL-termination, and still has a good return value). > > Agree. > > > Let's agree to *not* make horrible garbage when making up new versions > > of sprintf. > > Agree. I indeed introduced the mistake accidentally in v4, after you > complained of having too many functions, as I was introducing not one > but two APIs: seprintf() and stprintf(), where seprintf() is what now > we're calling sprintf_end(), and stprintf() we could call it > sprintf_trunc(). So I did the mistake by trying to reduce the number of > functions to just one, which is wrong. > > So, maybe I should go back to those functions, and just give them good > names. > > What do you think of the following? > > #define sprintf_array(a, ...) sprintf_trunc(a, ARRAY_SIZE(a), __VA_ARGS__) > #define vsprintf_array(a, ap) vsprintf_trunc(a, ARRAY_SIZE(a), ap) > > char *sprintf_end(char *p, const char end[0], const char *fmt, ...); > char *vsprintf_end(char *p, const char end[0], const char *fmt, va_list args); > int sprintf_trunc(char *buf, size_t size, const char *fmt, ...); > int vsprintf_trunc(char *buf, size_t size, const char *fmt, va_list args); > > char *sprintf_end(char *p, const char end[0], const char *fmt, ...) > { > va_list args; > > va_start(args, fmt); > p = vseprintf(p, end, fmt, args); > va_end(args); > > return p; > } > > char *vsprintf_end(char *p, const char end[0], const char *fmt, va_list args) > { > int len; > > if (unlikely(p == NULL)) > return NULL; > > len = vsprintf_trunc(p, end - p, fmt, args); > if (unlikely(len < 0)) > return NULL; > > return p + len; > } > > int sprintf_trunc(char *buf, size_t size, const char *fmt, ...) > { > va_list args; > int len; > > va_start(args, fmt); > len = vstprintf(buf, size, fmt, args); > va_end(args); > > return len; > } > > int vsprintf_trunc(char *buf, size_t size, const char *fmt, va_list args) > { > int len; > > if (WARN_ON_ONCE(size == 0 || size > INT_MAX)) > return -EOVERFLOW; > > len = vsnprintf(buf, size, fmt, args); > if (unlikely(len >= size)) > return -E2BIG; > > return len; > } > > sprintf_trunc() is like strscpy(), but with a formatted string. It > could replace uses of s[c]nprintf() where there's a single call (no > chained calls). > > sprintf_array() is like the 2-argument version of strscpy(). It could > replace s[c]nprintf() calls where there's no chained calls, where the > input is an array. > > sprintf_end() would replace the chained calls. > > Does this sound good to you? > > > Cheers, > Alex >