From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6FFBDC8303C for ; Mon, 7 Jul 2025 05:06:13 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 98D358D000C; Mon, 7 Jul 2025 01:06:12 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 8C7C38D0002; Mon, 7 Jul 2025 01:06:12 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 78F6B8D0003; Mon, 7 Jul 2025 01:06:12 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 5F8738D0002 for ; Mon, 7 Jul 2025 01:06:12 -0400 (EDT) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id BBFA41A038D for ; Mon, 7 Jul 2025 05:06:11 +0000 (UTC) X-FDA: 83636282142.05.FC82BD3 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf30.hostedemail.com (Postfix) with ESMTP id 02C6A80005 for ; Mon, 7 Jul 2025 05:06:09 +0000 (UTC) Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=j3aDEKSR; spf=pass (imf30.hostedemail.com: domain of alx@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=alx@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Authentication-Results: i=1; imf30.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=j3aDEKSR; spf=pass (imf30.hostedemail.com: domain of alx@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=alx@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1751864770; a=rsa-sha256; cv=none; b=Kl9elAovyIY1kH0/LCRxutF32xFsf09PJRlYUgxcJgAYfi6yQkN72hiyyDcW2NjPHrAuBb ieBtWGeB95T3/pwz/YmSY6GcEdrck1t9kyHmyppUUX9KI/XwD0mu+AlWr6nUJOY0gBDJth PKtOu0ClVxN5JjI0IYFf78HJDV6vVBY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1751864770; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=5VXyIw+NgcVC1CyowYH3S4P0b+rnQX8+FYUxV4CEt24=; b=z9Xg0IWoV0jPT0tMh+7bCik7Ea3Ohp8uon2flT/6q2Iymekei8cHHGC9Mk9UCk7W8UGhwy OqerIEdqZdp1QDa2BBXlklrgOxpHF3b68Z6wQF6tFHk+RP4/5imFIg9QcDV3cUSNXAV9iy EvXtAml1WaOZkoL2C3DkOOYyJXg9wSI= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id BB0C25C5789; Mon, 7 Jul 2025 05:06:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A9048C4CEE3; Mon, 7 Jul 2025 05:06:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1751864768; bh=OwXC6dVgryGV0YpSY2pOkIgNqEFTgCQQLN+wgWUl9KQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=j3aDEKSRz6T0v/Liop11NaaYtH19j9lG1lEET9wYKkFKmlqyixeOdEqAKZ88uk61j xJzQxWM0wxKsj6AbNgpBwQJwjLjQOjMF3ScAjlKBrxIkNO0VCk5fYSSPl33ki1FryK WkkcfewV7Fh4uCEN1aDvuOl1E2OzeZ2c25+SoBk8F+Yc7M49dx/UcJ9xTnAOwydldj GuFo1v7ZtMgSuRJ4TicIrAQT/PTXZz8uhkvnRjaEdgLPGXFNyMl/tWoeevxYVvvc3H r9Bzgbll3tnDudxyVURI0TJd6qiObtbG9Ti4fa+m+qE2WGD9X0a3CO7uNVQNefst/p U3ucOziEhayUA== Date: Mon, 7 Jul 2025 07:06:06 +0200 From: Alejandro Colomar To: linux-mm@kvack.org, linux-hardening@vger.kernel.org Cc: Alejandro Colomar , Kees Cook , Christopher Bazley , shadow <~hallyn/shadow@lists.sr.ht>, linux-kernel@vger.kernel.org, Andrew Morton , kasan-dev@googlegroups.com, Dmitry Vyukov , Alexander Potapenko , Marco Elver , Christoph Lameter , David Rientjes , Vlastimil Babka , Roman Gushchin , Harry Yoo , Andrew Clayton Subject: [RFC v3 0/7] Add and use seprintf() instead of less ergonomic APIs Message-ID: X-Mailer: git-send-email 2.50.0 References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 02C6A80005 X-Stat-Signature: pidjxrwpxtdq8hgqsky4zmacr6ae7r1w X-Rspam-User: X-HE-Tag: 1751864769-967153 X-HE-Meta: U2FsdGVkX1/L9uv2C0SQ98dt+sOfWhd/92rpKaB1w9aMf9Y/jLUkkrfBchpk2FIPdAijAwdfXBIIhZwIfJX6zrPZbnUS6pA8OXc+BvieOOt0cCHfCeukAkN3FrDFGM240ZgdUtsvxutw6t6nFUr08q1D2X8wdDBe6J099gOXJByPzaOHep3twAWULq9M/KhZ+aajbpjHE8edeM6WEn3/SbN8SB1s12lAphrkIgpv8xXBMqi+K8TRFftvAE9oJRE1f3I/H/takGhj64nY2wAKV/MMSqanYWczYBFYCWFd94vi7z/cTedd2PJ9FaoqynvUs+T3FWh3kfkgRZwPAbePs3Dl2Z25bdNRymrafGFfUYRu6y5D6EWLOaVZSdLTTbdkSF86nVEYKm1okOYLoZKQhalcDA7kaNV85jXoTapS0OEogX7Jl9JHtEriFXe+i/DEVnuAEPkTmmd5ei1gVGwzeqO+pUVt3a8yZkD+0UUtlsBllhIzazpYiTmsrPNXMoAj4fHsECGo+DoR/+wj/sTmcyS4EEVLB2b9kh6pWriID3QB3kKEjwvbPmo7V01Y2GkAyA7MFPTPrpuZzQGfCh0k0VkY8F1/F41btd1+LHZAvrunff+1SZwb2ibbMgQ/1gs29afpnQH1+Rq009KjWEj6NG+fNlK83kiitgQ3dOJFGvOG8WHAxkBYpDWRY5ONvng7JuDgDrDDtiokzyovMPmJM4ZVM7iX9su6HovwMUhjoTaoQaUNWb3R21w2Ciq9AEZzMOkuuIzAHts3uGVNYcJ6/eV2KBHjscwgi8+iBjkSJlNR5xG6tcGXbDVAvRQFMR4k5qQSvECBa0cdnUxhIDHGjBJzrVfgKK7ASe7NLEiD1s2ekNIvDg4lwYPuenbXicE2+Z23qjujft+FJ2fHPxJ26hw7c1KYDkBo35HLwLTNB2i1UErxPeS/VBUTY5P39QaYqmBbEbsq1JiPezb9CFw Lw5Idpm1 WOudkqi/X6z+nOyGLXnTjlq7VB+YwP7wP6rxa3ybyodnsDOqscHEOb3RsqB2O7iDz3Zp8FtMJ0cAHDZHR2TdXfZ2/IQ67zA3UcOIyDwUAVGsW14pkSVDxsfkozEcUuC9nO/lmMzEGNdYi7ucnxfD/qAdvNhrzbpGgHZPe6lKldI3hLQEVIKv/lPEJ8+WeQcxH/kvdE0Gx5J0fPL1iyVQJa+qeEylmDAHbL0uLPcv78IhxuSPFf0Q2YsZfgn/d7KDIb9FhE+EOco5FYGAgLFsxmvBTwJcNPyAOmy3pNMMCXRLCbf20naZ94DzKWFDePwDwZ/oShvWcwv7Ixvgafo18hJWaolB1OL3wSfCkchhOqqYBs6pwOGLqjys2GRakU2ifgzH8TNCR4c3hlBtxFSPF7N4Lpa6rjFw5LRjNnoiobVoTZiruKmOrMO/Ke4dBht69ttSxi/LQOsOULNafhmwT09zMq1vrl8mp5QtWtSkTJMvEAN+WSc+s2l2tEKtxrvpGTa9Tp7w6HW9GuNCOdALDXwcblRUNIrtyUyoitNYi3unh1qfjjp4E4gs3V/NeCifTLzlk X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hi, In this v3: - I've added Fixes: tags for all commits that introduced issues being fixed in this patch set. I've also added the people who signed or reviewed those patches to CC. - I've fixed a typo in a comment. - I've also added a STPRINTF() macro and used it to remove explicit uses of sizeof(). Now, only 5 calls to snprintf(3) remain under mm/: $ grep -rnI nprint mm/ mm/hugetlb_cgroup.c:674: snprintf(buf, size, "%luGB", hsize / SZ_1G); mm/hugetlb_cgroup.c:676: snprintf(buf, size, "%luMB", hsize / SZ_1M); mm/hugetlb_cgroup.c:678: snprintf(buf, size, "%luKB", hsize / SZ_1K); mm/kfence/report.c:75: int len = scnprintf(buf, sizeof(buf), "%ps", (void *)stack_entries[skipnr]); mm/kmsan/report.c:42: len = scnprintf(buf, sizeof(buf), "%ps", The first three are fine. The remaining two, I'd like someone to check if they should be replaced by one of these wrappers. I had doubts about it, and would need someone understanding that code to check them. Mainly, do we really want to ignore truncation? The questions from v1 still are in the air. I've written an analysis of snprintf(3), why it's dangerous, and how these APIs address that, and will present it as a proposal for standardization of these APIs in ISO C2y. I'll send that as a reply to this message in a moment, as I believe it will be interesting for linux-hardening@. Have a lovely night! Alex Alejandro Colomar (7): vsprintf: Add [v]seprintf(), [v]stprintf() stacktrace, stackdepot: Add seprintf()-like variants of functions mm: Use seprintf() instead of less ergonomic APIs array_size.h: Add ENDOF() mm: Fix benign off-by-one bugs sprintf: Add [V]STPRINTF() mm: Use [V]STPRINTF() to avoid specifying the array size include/linux/array_size.h | 6 ++ include/linux/sprintf.h | 8 +++ include/linux/stackdepot.h | 13 +++++ include/linux/stacktrace.h | 3 + kernel/stacktrace.c | 28 ++++++++++ lib/stackdepot.c | 12 ++++ lib/vsprintf.c | 109 +++++++++++++++++++++++++++++++++++++ mm/backing-dev.c | 2 +- mm/cma.c | 4 +- mm/cma_debug.c | 2 +- mm/hugetlb.c | 3 +- mm/hugetlb_cgroup.c | 2 +- mm/hugetlb_cma.c | 2 +- mm/kasan/report.c | 3 +- mm/kfence/kfence_test.c | 28 +++++----- mm/kmsan/kmsan_test.c | 6 +- mm/memblock.c | 4 +- mm/mempolicy.c | 18 +++--- mm/page_owner.c | 32 ++++++----- mm/percpu.c | 2 +- mm/shrinker_debug.c | 2 +- mm/slub.c | 5 +- mm/zswap.c | 2 +- 23 files changed, 238 insertions(+), 58 deletions(-) Range-diff against v2: 1: 64334f0b94d6 = 1: 64334f0b94d6 vsprintf: Add [v]seprintf(), [v]stprintf() 2: 9c140de9842d = 2: 9c140de9842d stacktrace, stackdepot: Add seprintf()-like variants of functions 3: e3271b5f2ad9 ! 3: 033bf00f1fcf mm: Use seprintf() instead of less ergonomic APIs @@ Commit message Again, the 'p += snprintf()' anti-pattern. This is UB, and by using seprintf() we've fixed the bug. + Fixes: f99e12b21b84 (2021-07-30; "kfence: add function to mask address bits") + [alx: that commit introduced dead code] + Fixes: af649773fb25 (2024-07-17; "mm/numa_balancing: teach mpol_to_str about the balancing mode") + [alx: that commit added p+=snprintf() calls, which are UB] + Fixes: 2291990ab36b (2008-04-28; "mempolicy: clean-up mpol-to-str() mempolicy formatting") + [alx: that commit changed p+=sprintf() into p+=snprintf(), which is still UB] + Fixes: 948927ee9e4f (2013-11-13; "mm, mempolicy: make mpol_to_str robust and always succeed") + [alx: that commit changes old code into p+=snprintf(), which is still UB] + [alx: that commit also produced dead code by leaving the last 'p+=...'] + Fixes: d65360f22406 (2022-09-26; "mm/slub: clean up create_unique_id()") + [alx: that commit changed p+=sprintf() into p+=snprintf(), which is still UB] Cc: Kees Cook Cc: Christopher Bazley + Cc: Sven Schnelle + Cc: Marco Elver + Cc: Heiko Carstens + Cc: Tvrtko Ursulin + Cc: "Huang, Ying" + Cc: Andrew Morton + Cc: Lee Schermerhorn + Cc: Linus Torvalds + Cc: David Rientjes + Cc: Christophe JAILLET + Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> + Cc: Chao Yu + Cc: Vlastimil Babka Signed-off-by: Alejandro Colomar ## mm/kfence/kfence_test.c ## 4: 5331d286ceca ! 4: d8bd0e1d308b array_size.h: Add ENDOF() @@ include/linux/array_size.h #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr)) +/** -+ * ENDOF - get a pointer to one past the last element in array @arr -+ * @arr: array ++ * ENDOF - get a pointer to one past the last element in array @a ++ * @a: array + */ +#define ENDOF(a) (a + ARRAY_SIZE(a)) + 5: 08cfdd2bf779 ! 5: 740755c1a888 mm: Fix benign off-by-one bugs @@ Commit message 'end' --that is, at most the terminating null byte will be written at 'end-1'--. + Fixes: bc8fbc5f305a (2021-02-26; "kfence: add test suite") + Fixes: 8ed691b02ade (2022-10-03; "kmsan: add tests for KMSAN") Cc: Kees Cook Cc: Christopher Bazley + Cc: Alexander Potapenko + Cc: Marco Elver + Cc: Dmitry Vyukov + Cc: Alexander Potapenko + Cc: Jann Horn + Cc: Andrew Morton + Cc: Linus Torvalds Signed-off-by: Alejandro Colomar ## mm/kfence/kfence_test.c ## -: ------------ > 6: 44d05559398c sprintf: Add [V]STPRINTF() -: ------------ > 7: d0e95db3c80a mm: Use [V]STPRINTF() to avoid specifying the array size -- 2.50.0