Hi Jane, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on linus/master] [also build test WARNING on v6.1-rc1 next-20221018] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Jane-Chu/vsprintf-protect-kernel-from-panic-due-to-non-canonical-pointer-dereference/20221018-034659 patch link: https://lore.kernel.org/r/20221017194447.2579441-1-jane.chu%40oracle.com patch subject: [PATCH v2] vsprintf: protect kernel from panic due to non-canonical pointer dereference config: i386-randconfig-a005 compiler: gcc-11 (Debian 11.3.0-8) 11.3.0 reproduce (this is a W=1 build): # https://github.com/intel-lab-lkp/linux/commit/63a24b7174d63b2daa240f00f66913649cb8ae84 git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Jane-Chu/vsprintf-protect-kernel-from-panic-due-to-non-canonical-pointer-dereference/20221018-034659 git checkout 63a24b7174d63b2daa240f00f66913649cb8ae84 # save the config file mkdir build_dir && cp config build_dir/.config make W=1 O=build_dir ARCH=i386 SHELL=/bin/bash If you fix the issue, kindly add following tag where applicable | Reported-by: kernel test robot All warnings (new ones prefixed by >>): lib/vsprintf.c: In function 'va_format': lib/vsprintf.c:1688:9: warning: function 'va_format' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] 1688 | buf += vsnprintf(buf, end > buf ? end - buf : 0, va_fmt->fmt, va); | ^~~ lib/vsprintf.c: In function 'dentry_name': >> lib/vsprintf.c:937:18: warning: array subscript -1 is below array bounds of 'const char *[4]' [-Warray-bounds] 937 | s = array[--i]; | ~~~~~^~~~~ lib/vsprintf.c:908:21: note: while referencing 'array' 908 | const char *array[4], *s; | ^~~~~ vim +937 lib/vsprintf.c 6eea242f9bcdf8 Petr Mladek 2019-04-17 903 4b6ccca701ef59 Al Viro 2013-09-03 904 static noinline_for_stack 4b6ccca701ef59 Al Viro 2013-09-03 905 char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_spec spec, 4b6ccca701ef59 Al Viro 2013-09-03 906 const char *fmt) 4b6ccca701ef59 Al Viro 2013-09-03 907 { 4b6ccca701ef59 Al Viro 2013-09-03 908 const char *array[4], *s; 4b6ccca701ef59 Al Viro 2013-09-03 909 const struct dentry *p; 4b6ccca701ef59 Al Viro 2013-09-03 910 int depth; 4b6ccca701ef59 Al Viro 2013-09-03 911 int i, n; 4b6ccca701ef59 Al Viro 2013-09-03 912 4b6ccca701ef59 Al Viro 2013-09-03 913 switch (fmt[1]) { 4b6ccca701ef59 Al Viro 2013-09-03 914 case '2': case '3': case '4': 4b6ccca701ef59 Al Viro 2013-09-03 915 depth = fmt[1] - '0'; 4b6ccca701ef59 Al Viro 2013-09-03 916 break; 4b6ccca701ef59 Al Viro 2013-09-03 917 default: 4b6ccca701ef59 Al Viro 2013-09-03 918 depth = 1; 4b6ccca701ef59 Al Viro 2013-09-03 919 } 4b6ccca701ef59 Al Viro 2013-09-03 920 4b6ccca701ef59 Al Viro 2013-09-03 921 rcu_read_lock(); 4b6ccca701ef59 Al Viro 2013-09-03 922 for (i = 0; i < depth; i++, d = p) { 3e5903eb9cff70 Petr Mladek 2019-04-17 923 if (check_pointer(&buf, end, d, spec)) { 3e5903eb9cff70 Petr Mladek 2019-04-17 924 rcu_read_unlock(); 3e5903eb9cff70 Petr Mladek 2019-04-17 925 return buf; 3e5903eb9cff70 Petr Mladek 2019-04-17 926 } 3e5903eb9cff70 Petr Mladek 2019-04-17 927 6aa7de059173a9 Mark Rutland 2017-10-23 928 p = READ_ONCE(d->d_parent); 6aa7de059173a9 Mark Rutland 2017-10-23 929 array[i] = READ_ONCE(d->d_name.name); 4b6ccca701ef59 Al Viro 2013-09-03 930 if (p == d) { 4b6ccca701ef59 Al Viro 2013-09-03 931 if (i) 4b6ccca701ef59 Al Viro 2013-09-03 932 array[i] = ""; 4b6ccca701ef59 Al Viro 2013-09-03 933 i++; 4b6ccca701ef59 Al Viro 2013-09-03 934 break; 4b6ccca701ef59 Al Viro 2013-09-03 935 } 4b6ccca701ef59 Al Viro 2013-09-03 936 } 4b6ccca701ef59 Al Viro 2013-09-03 @937 s = array[--i]; 4b6ccca701ef59 Al Viro 2013-09-03 938 for (n = 0; n != spec.precision; n++, buf++) { 4b6ccca701ef59 Al Viro 2013-09-03 939 char c = *s++; 4b6ccca701ef59 Al Viro 2013-09-03 940 if (!c) { 4b6ccca701ef59 Al Viro 2013-09-03 941 if (!i) 4b6ccca701ef59 Al Viro 2013-09-03 942 break; 4b6ccca701ef59 Al Viro 2013-09-03 943 c = '/'; 4b6ccca701ef59 Al Viro 2013-09-03 944 s = array[--i]; 4b6ccca701ef59 Al Viro 2013-09-03 945 } 4b6ccca701ef59 Al Viro 2013-09-03 946 if (buf < end) 4b6ccca701ef59 Al Viro 2013-09-03 947 *buf = c; 4b6ccca701ef59 Al Viro 2013-09-03 948 } 4b6ccca701ef59 Al Viro 2013-09-03 949 rcu_read_unlock(); cfccde04e28d26 Rasmus Villemoes 2016-01-15 950 return widen_string(buf, n, end, spec); 4b6ccca701ef59 Al Viro 2013-09-03 951 } 4b6ccca701ef59 Al Viro 2013-09-03 952 -- 0-DAY CI Kernel Test Service https://01.org/lkp