[PATCH 0/2] tools/nolibc: fix verrx() and errx()

[PATCH 0/2] tools/nolibc: fix verrx() and errx()

[Danish Khateeb]

verrx() passes its va_list to the variadic warnx() instead of vwarnx(),
so errx() and verrx() print their messages with the wrong arguments,
and can crash when the format has a "%s".

Patch 1 fixes it. Patch 2 adds a nolibc-test case for errx(), which
would have caught it.

The series is independent of the readdir_r()/FD_* series [1] and merges
cleanly with it.

Tested on top of nolibc/for-next 61fb00d6efee, on x86_64 and i386, and
on arm, arm64 and sparc64 under qemu-user:

- nolibc-test, all tests: no failures with the series. The only
  difference from before is the new errx test, which passes. It also
  passes against glibc (make libc-test).

- Without patch 1, the errx test fails on all five. On x86_64 the child
  is killed by SIGSEGV.

[1] https://lore.kernel.org/all/20260924015222.31693-1-danishkhateeb03@gmail.com/

Danish Khateeb (2):
  tools/nolibc: fix verrx() and errx() message formatting
  selftests/nolibc: add a test for errx()

 tools/include/nolibc/err.h                   |  2 +-
 tools/testing/selftests/nolibc/nolibc-test.c | 47 ++++++++++++++++++++
 2 files changed, 48 insertions(+), 1 deletion(-)


base-commit: 61fb00d6efeeeb9fd65c81db3bd8b2ac140f573c
-- 
2.55.0

[PATCH 1/2] tools/nolibc: fix verrx() and errx() message formatting

[Danish Khateeb]

verrx() passes its va_list to warnx() instead of vwarnx(). warnx() is
variadic, so it takes the va_list as its first and only argument, and
the conversions in the format string print the va_list itself and then
whatever is left in the following argument slots. On x86_64, for
instance,

	errx(1, "int args: %d %d %d", 1, 2, 3);

prints something like "int args: -1699009032 1 2", where the first
number comes from the address of the va_list and changes from run to
run, and

	errx(1, "%d %s", 1234, "foo");

crashes with SIGSEGV, as "%s" takes a leftover argument slot for the
string. errx() goes through verrx(), so every message with arguments
printed by either of them is wrong.

Call vwarnx(), as verr() calls vwarn().

Fixes: 9da0f529c089 ("tools/nolibc: add err.h")
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
---
 tools/include/nolibc/err.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/include/nolibc/err.h b/tools/include/nolibc/err.h
index e22ae87a7289..61978d537ed8 100644
--- a/tools/include/nolibc/err.h
+++ b/tools/include/nolibc/err.h
@@ -60,7 +60,7 @@ void verr(int eval, const char *fmt, va_list args)
 static __attribute__((noreturn, unused))
 void verrx(int eval, const char *fmt, va_list args)
 {
-	warnx(fmt, args);
+	vwarnx(fmt, args);
 	exit(eval);
 }
 
-- 
2.55.0

[PATCH 2/2] selftests/nolibc: add a test for errx()

[Danish Khateeb]

nolibc-test does not call any of the err.h functions, so nothing
noticed that verrx(), and errx() through it, printed their messages
with the wrong arguments, or crashed.

Add a test that calls errx() in a child with stderr redirected to a
pipe, and checks the exit status and the message.

Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
---
 tools/testing/selftests/nolibc/nolibc-test.c | 47 ++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
index 37c11a7fce23..1447c2e39af5 100644
--- a/tools/testing/selftests/nolibc/nolibc-test.c
+++ b/tools/testing/selftests/nolibc/nolibc-test.c
@@ -32,6 +32,7 @@
 #include <sys/utsname.h>
 #include <sys/wait.h>
 #include <dirent.h>
+#include <err.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <poll.h>
@@ -2223,6 +2224,51 @@ int test_asprintf(void)
 	return 0;
 }
 
+int test_errx(void)
+{
+	char buf[100], expected[100];
+	int pipefd[2], status;
+	ssize_t len;
+	pid_t pid;
+
+	if (pipe(pipefd) == -1)
+		return 1;
+
+	/* flush the printf buffer to avoid child flush it */
+	fflush(stdout);
+	fflush(stderr);
+
+	pid = fork();
+	if (pid == -1) {
+		close(pipefd[0]);
+		close(pipefd[1]);
+		return 2;
+	}
+
+	if (pid == 0) {
+		dup2(pipefd[1], STDERR_FILENO);
+		errx(42, "%d %s", 1234, "foo");
+	}
+
+	close(pipefd[1]);
+	pid = waitpid(pid, &status, 0);
+	len = read(pipefd[0], buf, sizeof(buf) - 1);
+	close(pipefd[0]);
+
+	if (pid == -1 || !WIFEXITED(status) || WEXITSTATUS(status) != 42)
+		return 3;
+
+	if (len == -1)
+		return 4;
+	buf[len] = 0;
+
+	snprintf(expected, sizeof(expected), "%s: 1234 foo\n", program_invocation_short_name);
+	if (strcmp(buf, expected) != 0)
+		return 5;
+
+	return 0;
+}
+
 static int run_printf(int min, int max)
 {
 	int test;
@@ -2287,6 +2333,7 @@ static int run_printf(int min, int max)
 		CASE_TEST(scanf);        EXPECT_ZR(1, test_scanf()); break;
 		CASE_TEST(printf_error); EXPECT_ZR(1, test_printf_error()); break;
 		CASE_TEST(asprintf);     EXPECT_ZR(1, test_asprintf()); break;
+		CASE_TEST(errx);         EXPECT_ZR(1, test_errx()); break;
 		case __LINE__:
 			return ret; /* must be last */
 		/* note: do not set any defaults so as to permit holes above */
-- 
2.55.0

Re: [PATCH 0/2] tools/nolibc: fix verrx() and errx()

[Thomas Weißschuh]

On 2026-09-24 07:09:56-0500, Danish Khateeb wrote:
> verrx() passes its va_list to the variadic warnx() instead of vwarnx(),
> so errx() and verrx() print their messages with the wrong arguments,
> and can crash when the format has a "%s".
> 
> Patch 1 fixes it. Patch 2 adds a nolibc-test case for errx(), which
> would have caught it.
> 
> The series is independent of the readdir_r()/FD_* series [1] and merges
> cleanly with it.
> 
> Tested on top of nolibc/for-next 61fb00d6efee, on x86_64 and i386, and
> on arm, arm64 and sparc64 under qemu-user:
> 
> - nolibc-test, all tests: no failures with the series. The only
>   difference from before is the new errx test, which passes. It also
>   passes against glibc (make libc-test).
> 
> - Without patch 1, the errx test fails on all five. On x86_64 the child
>   is killed by SIGSEGV.
> 
> [1] https://lore.kernel.org/all/20260924015222.31693-1-danishkhateeb03@gmail.com/
> 
> Danish Khateeb (2):
>   tools/nolibc: fix verrx() and errx() message formatting
>   selftests/nolibc: add a test for errx()

Thanks!

I picked up the bugfix. The selftests looks like a lot of additional
code for the value it provides, so I didn't apply it.

>  tools/include/nolibc/err.h                   |  2 +-
>  tools/testing/selftests/nolibc/nolibc-test.c | 47 ++++++++++++++++++++
>  2 files changed, 48 insertions(+), 1 deletion(-)
> 
> 
> base-commit: 61fb00d6efeeeb9fd65c81db3bd8b2ac140f573c
> -- 
> 2.55.0
>