From 71876dffab295b6e25d4209f0424da8fc5020e12 Mon Sep 17 00:00:00 2001 From: "Masami Hiramatsu (Google)" Date: Thu, 26 Mar 2026 21:12:00 +0900 Subject: [PATCH 1/9] lib/vsprintf: Fix to check field_width and precision Check the field_width and presition correctly. Previously it depends on the bitfield conversion from int to check out-of-range error. However, commit 938df695e98d ("vsprintf: associate the format state with the format pointer") changed those fields to int. We need to check the out-of-range correctly without bitfield conversion. Fixes: 938df695e98d ("vsprintf: associate the format state with the format pointer") Reported-by: David Laight Closes: https://lore.kernel.org/all/20260318151250.40fef0ab@pumpkin/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Petr Mladek Link: https://patch.msgid.link/177452712047.197965.16376597502504928495.stgit@devnote2 Signed-off-by: Petr Mladek --- lib/vsprintf.c | 36 ++++++++++++++---------------------- 1 file changed, 14 insertions(+), 22 deletions(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 9f359b31c8d1..3c76cc5c7f9c 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -2640,6 +2640,18 @@ static unsigned char spec_flag(unsigned char c) return (c < sizeof(spec_flag_array)) ? spec_flag_array[c] : 0; } +static void set_field_width(struct printf_spec *spec, int width) +{ + spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX); + WARN_ONCE(spec->field_width != width, "field width %d out of range", width); +} + +static void set_precision(struct printf_spec *spec, int prec) +{ + spec->precision = clamp(prec, 0, PRECISION_MAX); + WARN_ONCE(spec->precision < prec, "precision %d too large", prec); +} + /* * Helper function to decode printf style format. * Each call decode a token from the format and return the @@ -2710,7 +2722,7 @@ struct fmt format_decode(struct fmt fmt, struct printf_spec *spec) spec->field_width = -1; if (isdigit(*fmt.str)) - spec->field_width = skip_atoi(&fmt.str); + set_field_width(spec, skip_atoi(&fmt.str)); else if (unlikely(*fmt.str == '*')) { /* it's the next argument */ fmt.state = FORMAT_STATE_WIDTH; @@ -2724,9 +2736,7 @@ struct fmt format_decode(struct fmt fmt, struct printf_spec *spec) if (unlikely(*fmt.str == '.')) { fmt.str++; if (isdigit(*fmt.str)) { - spec->precision = skip_atoi(&fmt.str); - if (spec->precision < 0) - spec->precision = 0; + set_precision(spec, skip_atoi(&fmt.str)); } else if (*fmt.str == '*') { /* it's the next argument */ fmt.state = FORMAT_STATE_PRECISION; @@ -2799,24 +2809,6 @@ struct fmt format_decode(struct fmt fmt, struct printf_spec *spec) return fmt; } -static void -set_field_width(struct printf_spec *spec, int width) -{ - spec->field_width = width; - if (WARN_ONCE(spec->field_width != width, "field width %d too large", width)) { - spec->field_width = clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX); - } -} - -static void -set_precision(struct printf_spec *spec, int prec) -{ - spec->precision = prec; - if (WARN_ONCE(spec->precision != prec, "precision %d too large", prec)) { - spec->precision = clamp(prec, 0, PRECISION_MAX); - } -} - /* * Turn a 1/2/4-byte value into a 64-bit one for printing: truncate * as necessary and deal with signedness. From e56185668dc12983dd0e75e38ed6dea98b01d2d2 Mon Sep 17 00:00:00 2001 From: "Masami Hiramatsu (Google)" Date: Thu, 26 Mar 2026 21:12:10 +0900 Subject: [PATCH 2/9] lib/vsprintf: Limit the returning size to INT_MAX The return value of vsnprintf() and bstr_printf() can overflow INT_MAX and return a minus value. In the @size is checked input overflow, but it does not check the output, which is expected required size. This should never happen but it should be checked and limited. Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Petr Mladek Link: https://patch.msgid.link/177452713020.197965.3164174544083829000.stgit@devnote2 Signed-off-by: Petr Mladek --- lib/vsprintf.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 3c76cc5c7f9c..6b1213d070b4 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -2856,6 +2856,7 @@ static unsigned long long convert_num_spec(unsigned int val, int size, struct pr int vsnprintf(char *buf, size_t size, const char *fmt_str, va_list args) { char *str, *end; + size_t ret_size; struct printf_spec spec = {0}; struct fmt fmt = { .str = fmt_str, @@ -2975,8 +2976,12 @@ int vsnprintf(char *buf, size_t size, const char *fmt_str, va_list args) } /* the trailing null byte doesn't count towards the total */ - return str-buf; + ret_size = str - buf; + /* Make sure the return value is within the positive integer range */ + if (WARN_ON_ONCE(ret_size > INT_MAX)) + ret_size = INT_MAX; + return ret_size; } EXPORT_SYMBOL(vsnprintf); @@ -3280,6 +3285,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt_str, const u32 *bin_buf) struct printf_spec spec = {0}; char *str, *end; const char *args = (const char *)bin_buf; + size_t ret_size; if (WARN_ON_ONCE(size > INT_MAX)) return 0; @@ -3428,7 +3434,12 @@ int bstr_printf(char *buf, size_t size, const char *fmt_str, const u32 *bin_buf) #undef get_arg /* the trailing null byte doesn't count towards the total */ - return str - buf; + ret_size = str - buf; + + /* Make sure the return value is within the positive integer range */ + if (WARN_ON_ONCE(ret_size > INT_MAX)) + ret_size = INT_MAX; + return ret_size; } EXPORT_SYMBOL_GPL(bstr_printf); From d1c9b60b6d7bb6ac973e9fb3f430618ab237ea9b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Mon, 4 May 2026 12:43:40 +0200 Subject: [PATCH 3/9] vsprintf: Only export no_hash_pointers to test module MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Aside from the printf test module, no module should ever use this symbol. Suggested-by: Petr Mladek Link: https://lore.kernel.org/all/aWpwMyFEfpCNN297@pathway.suse.cz/ Suggested-by: Andy Shevchenko Link: https://lore.kernel.org/all/aW3em-KplLVofU5z@smile.fi.intel.com/ Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Mladek Tested-by: Petr Mladek Link: https://patch.msgid.link/20260504-restricted-pointers-kunit-test-v2-1-19e8b1c0fbeb@linutronix.de [pmladek@suse.com: Removed questionable ifdeffery.] Signed-off-by: Petr Mladek --- lib/vsprintf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 9f359b31c8d1..cbcc47bf8510 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -59,7 +59,7 @@ /* Disable pointer hashing if requested */ bool no_hash_pointers __ro_after_init; -EXPORT_SYMBOL_GPL(no_hash_pointers); +EXPORT_SYMBOL_FOR_MODULES(no_hash_pointers, "printf_kunit"); /* * Hashed pointers policy selected by "hash_pointers=..." boot param From 4d56efe69decb086796b68826aad2a4eeb9b788d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Mon, 4 May 2026 12:43:41 +0200 Subject: [PATCH 4/9] vsprintf: Add test for restricted kernel pointers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fill out the tests for restricted kernel pointers, using the %pK format. Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Mladek Tested-by: Petr Mladek Link: https://patch.msgid.link/20260504-restricted-pointers-kunit-test-v2-2-19e8b1c0fbeb@linutronix.de [pmladek@suse.com: Removed questionable ifdeffery.] Signed-off-by: Petr Mladek --- lib/tests/printf_kunit.c | 22 +++++++++++++++++++++- lib/vsprintf.c | 1 + 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/lib/tests/printf_kunit.c b/lib/tests/printf_kunit.c index bb70b9cddadd..58e639b01e83 100644 --- a/lib/tests/printf_kunit.c +++ b/lib/tests/printf_kunit.c @@ -319,7 +319,27 @@ symbol_ptr(struct kunit *kunittest) static void kernel_ptr(struct kunit *kunittest) { - /* We can't test this without access to kptr_restrict. */ + switch (kptr_restrict) { + case 0: + if (no_hash_pointers) { + test(PTR_STR, "%pK", PTR); + } else { + char buf[PLAIN_BUF_SIZE]; + + plain_hash_to_buffer(kunittest, PTR, buf, PLAIN_BUF_SIZE); + /* %pK behaves the same as hashing */ + test(buf, "%pK", PTR); + } + break; + case 1: + /* The KUnit kthread has all capabilities, including CAP_SYSLOG */ + test(PTR_STR, "%pK", PTR); + break; + case 2: + default: + test(ZEROS "00000000", "%pK", PTR); + break; + } } static void diff --git a/lib/vsprintf.c b/lib/vsprintf.c index cbcc47bf8510..d700dd0a5261 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -857,6 +857,7 @@ static char *default_pointer(char *buf, char *end, const void *ptr, } int kptr_restrict __read_mostly; +EXPORT_SYMBOL_FOR_MODULES(kptr_restrict, "printf_kunit"); static noinline_for_stack char *restricted_pointer(char *buf, char *end, const void *ptr, From b09b6d0c404d62480dbc23865c763c63598511f5 Mon Sep 17 00:00:00 2001 From: Kaitao Cheng Date: Tue, 19 May 2026 21:01:17 +0800 Subject: [PATCH 5/9] lib/vsprintf: Require exact hash_pointers mode matches hash_pointers= accepts a small set of mode strings, but the parser uses strncmp() with the length of each valid mode. That accepts values with trailing garbage, such as hash_pointers=autobots or hash_pointers=nevermind, as valid aliases for auto and never. Use strcmp() so that only the documented mode strings are accepted. Invalid values will continue to fall back to auto through the existing unknown-mode path. Signed-off-by: Kaitao Cheng Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20260519130117.48097-1-kaitao.cheng@linux.dev Signed-off-by: Petr Mladek --- lib/vsprintf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index d700dd0a5261..90b267b59254 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -2362,13 +2362,13 @@ static int __init hash_pointers_mode_parse(char *str) if (!str) { pr_warn("Hash pointers mode empty; falling back to auto.\n"); hash_pointers_mode = HASH_PTR_AUTO; - } else if (strncmp(str, "auto", 4) == 0) { + } else if (strcmp(str, "auto") == 0) { pr_info("Hash pointers mode set to auto.\n"); hash_pointers_mode = HASH_PTR_AUTO; - } else if (strncmp(str, "never", 5) == 0) { + } else if (strcmp(str, "never") == 0) { pr_info("Hash pointers mode set to never.\n"); hash_pointers_mode = HASH_PTR_NEVER; - } else if (strncmp(str, "always", 6) == 0) { + } else if (strcmp(str, "always") == 0) { pr_info("Hash pointers mode set to always.\n"); hash_pointers_mode = HASH_PTR_ALWAYS; } else { From 6a579050f8300adb794f09a5d1f4ff435d43ced5 Mon Sep 17 00:00:00 2001 From: Naveen Kumar Chaudhary Date: Mon, 1 Jun 2026 09:26:26 +0530 Subject: [PATCH 6/9] printk: fix typos in comments Fix spelling/grammatical errors in printk.c and nbcon.c: - "precation" -> "precautionary" - "othrewise" -> "otherwise" - "An usable" -> "A usable" - "made a progress" -> "made progress" - "preemtible" -> "preemptible" - "mechasism" -> "mechanism" - "ownerhip" -> "ownership" Signed-off-by: Naveen Kumar Chaudhary Link: https://patch.msgid.link/pakfewagyzb7da3yuxnaxdaoma5w4j2c7i3xebmcld3xy4mqs5@zxsx2idpxrdq Reviewed-by: Petr Mladek Signed-off-by: Petr Mladek --- kernel/printk/nbcon.c | 6 +++--- kernel/printk/printk.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/printk/nbcon.c b/kernel/printk/nbcon.c index d7044a7a214b..4b03b019cd5e 100644 --- a/kernel/printk/nbcon.c +++ b/kernel/printk/nbcon.c @@ -1487,7 +1487,7 @@ bool nbcon_allow_unsafe_takeover(void) * or write_thread(). * * When false, the write_thread() callback is used and would be - * called in a preemtible context unless disabled by the + * called in a preemptible context unless disabled by the * device_lock. The legacy handover is not allowed in this mode. * * Context: Any context except NMI. @@ -1868,7 +1868,7 @@ void nbcon_free(struct console *con) * Return: True if the console was acquired. False otherwise. * * Console drivers will usually use their own internal synchronization - * mechasism to synchronize between console printing and non-printing + * mechanism to synchronize between console printing and non-printing * activities (such as setting baud rates). However, nbcon console drivers * supporting atomic consoles may also want to mark unsafe sections when * performing non-printing activities in order to synchronize against their @@ -1954,7 +1954,7 @@ EXPORT_SYMBOL_GPL(nbcon_device_release); * * kdb emits messages on consoles registered for printk() without * storing them into the ring buffer. It has to acquire the console - * ownerhip so that it could call con->write_atomic() callback a safe way. + * ownership so that it could call con->write_atomic() callback a safe way. * * This function acquires the nbcon console using priority NBCON_PRIO_EMERGENCY * and marks it unsafe for handover/takeover. diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index 0323149548f6..2fe9a963c823 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -188,7 +188,7 @@ static int __init control_devkmsg(char *str) /* * Sysctl cannot change it anymore. The kernel command line setting of * this parameter is to force the setting to be permanent throughout the - * runtime of the system. This is a precation measure against userspace + * runtime of the system. This is a precautionary measure against userspace * trying to be a smarta** and attempting to change it up on us. */ devkmsg_log |= DEVKMSG_LOG_MASK_LOCK; @@ -1975,7 +1975,7 @@ int console_lock_spinning_disable_and_check(int cookie) * the current owner is running and cannot reschedule until it * is ready to lose the lock. * - * Return: 1 if we got the lock, 0 othrewise + * Return: 1 if we got the lock, 0 otherwise */ static int console_trylock_spinning(void) { @@ -3285,7 +3285,7 @@ static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool * continue; /* - * An usable console made a progress. There might still be + * A usable console made progress. There might still be * pending messages. */ *try_again = true; From 26ea7f319a1fe48cfcf0714a5f459443742aca31 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Mon, 18 May 2026 14:31:47 +0200 Subject: [PATCH 7/9] lib/vsprintf: replace min_t/max_t with min/max Use the simpler min()/max() macros since the values are all compatible. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260518123145.79411-3-thorsten.blum@linux.dev Signed-off-by: Petr Mladek --- lib/vsprintf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 90b267b59254..6c0aff78b3bc 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -1209,7 +1209,7 @@ char *hex_string(char *buf, char *end, u8 *addr, struct printf_spec spec, } if (spec.field_width > 0) - len = min_t(int, spec.field_width, 64); + len = min(spec.field_width, 64); for (i = 0; i < len; ++i) { if (buf < end) @@ -1234,7 +1234,7 @@ char *bitmap_string(char *buf, char *end, const unsigned long *bitmap, struct printf_spec spec, const char *fmt) { const int CHUNKSZ = 32; - int nr_bits = max_t(int, spec.field_width, 0); + int nr_bits = max(spec.field_width, 0); int i, chunksz; bool first = true; @@ -1277,7 +1277,7 @@ static noinline_for_stack char *bitmap_list_string(char *buf, char *end, const unsigned long *bitmap, struct printf_spec spec, const char *fmt) { - int nr_bits = max_t(int, spec.field_width, 0); + int nr_bits = max(spec.field_width, 0); bool first = true; int rbot, rtop; From 76c9ed5b81ea5e9a0837902fbd677f183e0a6df4 Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Wed, 3 Jun 2026 12:34:02 +0200 Subject: [PATCH 8/9] vsprintf: Add upper case flavour to %p[mM] Some of the (ABI aware) code needs an upper case when printing MAC addresses. Introduce an extension for that into the existing %p[mM]. Signed-off-by: Andy Shevchenko Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20260603104351.152085-2-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek --- Documentation/core-api/printk-formats.rst | 3 +++ lib/tests/printf_kunit.c | 2 ++ lib/vsprintf.c | 22 ++++++++++++++++------ 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/Documentation/core-api/printk-formats.rst b/Documentation/core-api/printk-formats.rst index c0b1b6089307..57e887ff24bc 100644 --- a/Documentation/core-api/printk-formats.rst +++ b/Documentation/core-api/printk-formats.rst @@ -322,6 +322,7 @@ MAC/FDDI addresses %pMF 00-01-02-03-04-05 %pm 000102030405 %pmR 050403020100 + %p[mM][FR][U] For printing 6-byte MAC/FDDI addresses in hex notation. The ``M`` and ``m`` specifiers result in a printed address with (M) or without (m) byte @@ -335,6 +336,8 @@ For Bluetooth addresses the ``R`` specifier shall be used after the ``M`` specifier to use reversed byte order suitable for visual interpretation of Bluetooth addresses which are in the little endian order. +When ``U`` is passed, the result is printed in the upper case. + Passed by reference. IPv4 addresses diff --git a/lib/tests/printf_kunit.c b/lib/tests/printf_kunit.c index bb70b9cddadd..6c7ce94383cf 100644 --- a/lib/tests/printf_kunit.c +++ b/lib/tests/printf_kunit.c @@ -415,8 +415,10 @@ mac(struct kunit *kunittest) test("2d:48:d6:fc:7a:05", "%pM", addr); test("05:7a:fc:d6:48:2d", "%pMR", addr); + test("05:7A:FC:D6:48:2D", "%pMRU", addr); test("2d-48-d6-fc-7a-05", "%pMF", addr); test("2d48d6fc7a05", "%pm", addr); + test("2D48D6FC7A05", "%pmU", addr); test("057afcd6482d", "%pmR", addr); } diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 9f359b31c8d1..3f79fe6342b6 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -1309,31 +1309,39 @@ char *mac_address_string(char *buf, char *end, u8 *addr, char mac_addr[sizeof("xx:xx:xx:xx:xx:xx")]; char *p = mac_addr; int i; - char separator; + char separator = ':'; bool reversed = false; + bool uc = false; if (check_pointer(&buf, end, addr, spec)) return buf; switch (fmt[1]) { case 'F': + uc = fmt[2] == 'U'; separator = '-'; break; case 'R': + uc = fmt[2] == 'U'; reversed = true; - fallthrough; + break; + + case 'U': + uc = true; + break; default: - separator = ':'; break; } for (i = 0; i < 6; i++) { - if (reversed) - p = hex_byte_pack(p, addr[5 - i]); + u8 byte = reversed ? addr[5 - i] : addr[i]; + + if (uc) + p = hex_byte_pack_upper(p, byte); else - p = hex_byte_pack(p, addr[i]); + p = hex_byte_pack(p, byte); if (fmt[0] == 'M' && i != 5) *p++ = separator; @@ -2416,6 +2424,7 @@ early_param("no_hash_pointers", no_hash_pointers_enable); * - 'MF' For a 6-byte MAC FDDI address, it prints the address * with a dash-separated hex notation * - '[mM]R' For a 6-byte MAC address, Reverse order (Bluetooth) + * - '[mM][FR][U]' One of the above in the upper case * - 'I' [46] for IPv4/IPv6 addresses printed in the usual way * IPv4 uses dot-separated decimal without leading 0's (1.2.3.4) * IPv6 uses colon separated network-order 16 bit hex with leading 0's @@ -2550,6 +2559,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, case 'm': /* Contiguous: 000102030405 */ /* [mM]F (FDDI) */ /* [mM]R (Reverse order; Bluetooth) */ + /* [mM][FR][U] (One of the above in the upper case) */ return mac_address_string(buf, end, ptr, spec, fmt); case 'I': /* Formatted IP supported * 4: 1.2.3.4 From 7cde5613006c1a1192efe3da3572d35a2fa5fbfe Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Wed, 3 Jun 2026 12:34:03 +0200 Subject: [PATCH 9/9] HID: nintendo: Use %pM format specifier for MAC addresses Convert to %pM instead of using custom code. Signed-off-by: Andy Shevchenko Acked-by: Benjamin Tissoires Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20260603104351.152085-3-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek --- drivers/hid/hid-nintendo.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c index 29008c2cc530..05c50f2530ef 100644 --- a/drivers/hid/hid-nintendo.c +++ b/drivers/hid/hid-nintendo.c @@ -2431,14 +2431,8 @@ static int joycon_read_info(struct joycon_ctlr *ctlr) for (i = 4, j = 0; j < 6; i++, j++) ctlr->mac_addr[j] = report->subcmd_reply.data[i]; - ctlr->mac_addr_str = devm_kasprintf(&ctlr->hdev->dev, GFP_KERNEL, - "%02X:%02X:%02X:%02X:%02X:%02X", - ctlr->mac_addr[0], - ctlr->mac_addr[1], - ctlr->mac_addr[2], - ctlr->mac_addr[3], - ctlr->mac_addr[4], - ctlr->mac_addr[5]); + ctlr->mac_addr_str = devm_kasprintf(&ctlr->hdev->dev, GFP_KERNEL, "%pMU", + ctlr->mac_addr); if (!ctlr->mac_addr_str) return -ENOMEM; hid_info(ctlr->hdev, "controller MAC = %s\n", ctlr->mac_addr_str);