linux-kernel - Re: [PATCH v2] wusb: use correct format characters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 Feb 2019 16:03:55 -0800
From:   Jon Flatley <jflat@...omium.org>
To:     Joe Perches <joe@...ches.com>
Cc:     Jon Flatley <jflat@...omium.org>, Louis Taylor <louis@...gniz.eu>,
        gregkh@...uxfoundation.org, linux-usb@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        clang-built-linux@...glegroups.com,
        Nick Desaulniers <ndesaulniers@...gle.com>
Subject: Re: [PATCH v2] wusb: use correct format characters

On Thu, Feb 28, 2019 at 3:05 PM Joe Perches <joe@...ches.com> wrote:
>
> On Thu, 2019-02-28 at 14:23 -0800, Jon Flatley wrote:
> > Thanks for the patch and comments.
> >
> > On Thu, Feb 28, 2019 at 1:53 PM Joe Perches <joe@...ches.com> wrote:
> > > On Thu, 2019-02-28 at 12:24 +0000, Louis Taylor wrote:
> > > > When compiling with -Wformat, clang warns:
> > > > ./include/linux/usb/wusb.h:245:5: warning: format specifies type
> > > > 'unsigned short' but the argument has type 'u8' (aka 'unsigned char')
> > > > [-Wformat]
> > > >   ckhdid->data[0],  ckhdid->data[1],
> > > >   ^~~~~~~~~~~~~~~
> > >
> > > I think the message is somewhat misguided as all the
> > > vararg arguments have implicit integer promotions.
> >
> > That's a fair point, but Clang checks the arguments against their
> > format specifier before they're promoted when using -Wformat.
>
> Perhaps clang could be a bit more verbose if
> checking signed types emitted as unsigned or
> unsigned types emitted as signed instead.

It is a little strange that clang warns when the length specifier
doesn't match but not when an unsigned specifier is used for a signed
value and vice versa.
>
> > When
> > considering integer promotions it's difficult to say if this is
> > "wrong",
>
> I didn't write "wrong", I wrote misguided.

Apologies for my poor wording. I meant "wrong" in the sense that it's
unclear if an improper length specifier is deserving of a warning.
After all GCC doesn't warn for incorrect length specifiers, and as you
pointed out Clang doesn't pay attention to if the specifier expects a
signed or unsigned value.

Cheers,
Jon