[PATCH v2 0/2] lib/vsprintf: Fixes size check

[PATCH v2 0/2] lib/vsprintf: Fixes size check

[Masami Hiramatsu (Google)]

Hi,

Here is a pair of patches to fix vsnprintf().

 - Fix to limit the size of width and precision.
 - Warn if the return size is over INT_MAX.

Recently we discussed snprintf() usage in bootconfig and found snprintf()
design has a problem[1]. It returns the required or printed size in 'int'
but the maxlen is passed by 'size_t'. The maxlen is already limited by
INT_MAX, but if the expected print size becomes bigger than INT_MAX,
it can return negative value. We also found width and precision size check
does not work.

[1] https://lore.kernel.org/all/20260317121507.30735331@gandalf.local.home/

Thank you,

---

Masami Hiramatsu (Google) (2):
      lib/vsprintf: Fix to check field_width and precision
      lib/vsprintf: Limit the returning size to INT_MAX


 lib/vsprintf.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--
Masami Hiramatsu (Google) <mhiramat@kernel.org>

[PATCH v2 1/2] lib/vsprintf: Fix to check field_width and precision

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Check the field_width and presition correctly. Previously it depends
on the bitfield conversion from int to check out-of-range error.
However, commit 938df695e98d ("vsprintf: associate the format state
with the format pointer") changed those fields to int.
We need to check the out-of-range correctly without bitfield
conversion.

Fixes: 938df695e98d ("vsprintf: associate the format state with the format pointer")
Reported-by: David Laight <david.laight.linux@gmail.com>
Closes: https://lore.kernel.org/all/20260318151250.40fef0ab@pumpkin/
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 Changes in v2:
  - Fix to use logical split.
---
 lib/vsprintf.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 800b8ac49f53..32a164e2adf4 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -2803,7 +2803,8 @@ static void
 set_field_width(struct printf_spec *spec, int width)
 {
 	spec->field_width = width;
-	if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) {
+	if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX || spec->field_width < -FIELD_WIDTH_MAX,
+		      "field width %d too large", width)) {
 		spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX);
 	}
 }
@@ -2812,7 +2813,8 @@ static void
 set_precision(struct printf_spec *spec, int prec)
 {
 	spec->precision = prec;
-	if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) {
+	if (WARN_ONCE(spec->precision > PRECISION_MAX || spec->precision < 0,
+		      "precision %d too large", prec)) {
 		spec->precision = clamp(prec, 0, PRECISION_MAX);
 	}
 }

Re: [PATCH v2 1/2] lib/vsprintf: Fix to check field_width and precision

[David Laight]

On Fri, 20 Mar 2026 12:54:48 +0900
"Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:

> From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> 
> Check the field_width and presition correctly. Previously it depends
> on the bitfield conversion from int to check out-of-range error.
> However, commit 938df695e98d ("vsprintf: associate the format state
> with the format pointer") changed those fields to int.
> We need to check the out-of-range correctly without bitfield
> conversion.
> 
> Fixes: 938df695e98d ("vsprintf: associate the format state with the format pointer")
> Reported-by: David Laight <david.laight.linux@gmail.com>
> Closes: https://lore.kernel.org/all/20260318151250.40fef0ab@pumpkin/
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> ---
>  Changes in v2:
>   - Fix to use logical split.
> ---
>  lib/vsprintf.c |    6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index 800b8ac49f53..32a164e2adf4 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -2803,7 +2803,8 @@ static void
>  set_field_width(struct printf_spec *spec, int width)
>  {
>  	spec->field_width = width;
> -	if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) {
> +	if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX || spec->field_width < -FIELD_WIDTH_MAX,

Check and update width before the assignment to spec->field_width.

	David

> +		      "field width %d too large", width)) {
>  		spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX);
>  	}
>  }
> @@ -2812,7 +2813,8 @@ static void
>  set_precision(struct printf_spec *spec, int prec)
>  {
>  	spec->precision = prec;
> -	if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) {
> +	if (WARN_ONCE(spec->precision > PRECISION_MAX || spec->precision < 0,
> +		      "precision %d too large", prec)) {
>  		spec->precision = clamp(prec, 0, PRECISION_MAX);
>  	}
>  }
> 

Re: [PATCH v2 1/2] lib/vsprintf: Fix to check field_width and precision

[Masami Hiramatsu]

On Fri, 20 Mar 2026 09:48:58 +0000
David Laight <david.laight.linux@gmail.com> wrote:

> On Fri, 20 Mar 2026 12:54:48 +0900
> "Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:
> 
> > From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> > 
> > Check the field_width and presition correctly. Previously it depends
> > on the bitfield conversion from int to check out-of-range error.
> > However, commit 938df695e98d ("vsprintf: associate the format state
> > with the format pointer") changed those fields to int.
> > We need to check the out-of-range correctly without bitfield
> > conversion.
> > 
> > Fixes: 938df695e98d ("vsprintf: associate the format state with the format pointer")
> > Reported-by: David Laight <david.laight.linux@gmail.com>
> > Closes: https://lore.kernel.org/all/20260318151250.40fef0ab@pumpkin/
> > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> > ---
> >  Changes in v2:
> >   - Fix to use logical split.
> > ---
> >  lib/vsprintf.c |    6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> > index 800b8ac49f53..32a164e2adf4 100644
> > --- a/lib/vsprintf.c
> > +++ b/lib/vsprintf.c
> > @@ -2803,7 +2803,8 @@ static void
> >  set_field_width(struct printf_spec *spec, int width)
> >  {
> >  	spec->field_width = width;
> > -	if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) {
> > +	if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX || spec->field_width < -FIELD_WIDTH_MAX,
> 
> Check and update width before the assignment to spec->field_width.
> 
> 	David

Indeed. I'll do the same for precision.

Thanks,

> 
> > +		      "field width %d too large", width)) {
> >  		spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX);
> >  	}
> >  }
> > @@ -2812,7 +2813,8 @@ static void
> >  set_precision(struct printf_spec *spec, int prec)
> >  {
> >  	spec->precision = prec;
> > -	if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) {
> > +	if (WARN_ONCE(spec->precision > PRECISION_MAX || spec->precision < 0,
> > +		      "precision %d too large", prec)) {
> >  		spec->precision = clamp(prec, 0, PRECISION_MAX);
> >  	}
> >  }
> > 
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

[PATCH v2 2/2] lib/vsprintf: Limit the returning size to INT_MAX

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

The return value of vsnprintf() can overflow INT_MAX and return
a minus value. In the @size is checked input overflow, but it does
not check the output, which is expected required size.

This should never happen but it should be checked and limited.

Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 lib/vsprintf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 32a164e2adf4..ea5e1d22ff8f 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -2985,7 +2985,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt_str, va_list args)
 	}
 
 	/* the trailing null byte doesn't count towards the total */
-	return str-buf;
+	return WARN_ON_ONCE(str - buf > INT_MAX) ? INT_MAX : str - buf;
 
 }
 EXPORT_SYMBOL(vsnprintf);

Re: [PATCH v2 2/2] lib/vsprintf: Limit the returning size to INT_MAX

[Petr Mladek]

On Fri 2026-03-20 12:54:57, Masami Hiramatsu (Google) wrote:
> From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> 
> The return value of vsnprintf() can overflow INT_MAX and return
> a minus value. In the @size is checked input overflow, but it does
> not check the output, which is expected required size.
> 
> This should never happen but it should be checked and limited.

Great catch!

> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -2985,7 +2985,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt_str, va_list args)
>  	}
>  
>  	/* the trailing null byte doesn't count towards the total */
> -	return str-buf;
> +	return WARN_ON_ONCE(str - buf > INT_MAX) ? INT_MAX : str - buf;

Is it guaranteed that the pointer arithmetic will be a big enough
unsigned number type?

I would rather do a cast to be on the safe side, for example:

	return WARN_ON_ONCE((size_t)(str - buf) > INT_MAX) ? INT_MAX : str - buf;

or even use a variable to make it better readable:

	size_t ret_size;

	ret_size = str - buf;
	if (WARN_ON_ONCE(ret_size > INT_MAX))
		ret_size = INT_MAX;
	return ret_size;

Best Regards,
Petr

Re: [PATCH v2 2/2] lib/vsprintf: Limit the returning size to INT_MAX

[Masami Hiramatsu]

On Fri, 20 Mar 2026 17:51:48 +0100
Petr Mladek <pmladek@suse.com> wrote:

> On Fri 2026-03-20 12:54:57, Masami Hiramatsu (Google) wrote:
> > From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> > 
> > The return value of vsnprintf() can overflow INT_MAX and return
> > a minus value. In the @size is checked input overflow, but it does
> > not check the output, which is expected required size.
> > 
> > This should never happen but it should be checked and limited.
> 
> Great catch!
> 
> > --- a/lib/vsprintf.c
> > +++ b/lib/vsprintf.c
> > @@ -2985,7 +2985,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt_str, va_list args)
> >  	}
> >  
> >  	/* the trailing null byte doesn't count towards the total */
> > -	return str-buf;
> > +	return WARN_ON_ONCE(str - buf > INT_MAX) ? INT_MAX : str - buf;
> 
> Is it guaranteed that the pointer arithmetic will be a big enough
> unsigned number type?
> 
> I would rather do a cast to be on the safe side, for example:
> 
> 	return WARN_ON_ONCE((size_t)(str - buf) > INT_MAX) ? INT_MAX : str - buf;

OK.

> 
> or even use a variable to make it better readable:
> 
> 	size_t ret_size;
> 
> 	ret_size = str - buf;
> 	if (WARN_ON_ONCE(ret_size > INT_MAX))
> 		ret_size = INT_MAX;
> 	return ret_size;

Ah, Indeed. Let me do this.

Thanks!

> 
> Best Regards,
> Petr


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>