linux-kernel - Re: [PATCH] printf: add _

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJ-ks9nYVuB6bn=xodzy5rWYtrwOgjev_53xRrzvMGdk55Y0Vw@mail.gmail.com>
Date: Sat, 6 Dec 2025 14:57:48 -0500
From: Tamir Duberstein <tamird@...nel.org>
To: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Cc: Petr Mladek <pmladek@...e.com>, Steven Rostedt <rostedt@...dmis.org>, 
	Rasmus Villemoes <linux@...musvillemoes.dk>, Sergey Senozhatsky <senozhatsky@...omium.org>, 
	Kees Cook <kees@...nel.org>, linux-kernel@...r.kernel.org, 
	oe-kbuild-all@...ts.linux.dev, kernel test robot <lkp@...el.com>
Subject: Re: [PATCH] printf: add __printf attribute

On Sat, Dec 6, 2025 at 2:43 PM Andy Shevchenko
<andriy.shevchenko@...ux.intel.com> wrote:
>
> On Sat, Dec 06, 2025 at 12:52:53PM -0500, Tamir Duberstein wrote:
> > On Sat, Dec 6, 2025 at 12:49 PM Andy Shevchenko
> > <andriy.shevchenko@...ux.intel.com> wrote:
> > > On Sat, Dec 06, 2025 at 12:13:34PM -0500, Tamir Duberstein wrote:
> > > > On Sat, Dec 6, 2025 at 11:11 AM Andy Shevchenko
> > > > <andriy.shevchenko@...ux.intel.com> wrote:
> > > > > On Sat, Dec 06, 2025 at 08:19:09AM -0500, Tamir Duberstein wrote:
>
> ...
>
> > > > > > -static void
> > > > > > +static void __printf(2, 3)
> > > > >
> > > > > 3?!
> > > > >
> > > > > I think it should be (2, 0). Yes, the both users call it with "%p..." in format
> > > > > string, but the second parameter tells compiler to check the variadic
> > > > > arguments, which are absent here. Changing 'const void *p' to '...' will align
> > > > > it with the given __printf() attribute, but I don't know if this what we want.
> > > >
> > > > The second parameter is the first-to-check, it is not specific to
> > > > variadic arguments. Using 0 means that no arguments are checkable, so
> > > > the compiler only validates the format string itself and won’t
> > > > diagnose mismatches with `p`. This works whether or not we later
> > > > change `const void *p` to `...`.
> > >
> > > Yes, but this is fragile. As I explained it works only because we supply
> > > the format string stuck to "%p", anything else will require reconsidering
> > > the function prototypes. So, strictly speaking this should be (2, 0) if
> > > we leave const void *p as is.
> > >
> > I believe this is not correct. As I said, 0 means "do not check
> > arguments" so only the format string will be checked. See the existing
> > uses of this annotation in this file:
> >
> > static void __printf(7, 0)
> > do_test(struct kunit *kunittest, const char *file, const int line, int
> > bufsize, const char *expect,
> > int elen, const char *fmt, va_list ap)
> >
> > and
> >
> > static void __printf(6, 7)
> > __test(struct kunit *kunittest, const char *file, const int line,
> > const char *expect, int elen,
> > const char *fmt, ...)
> >
> > as you can see, 0 is used only when the arguments are not in the
> > function prototype at all. When variadic arguments are present, N+1 is
> > used.
>
> Yes to all what you said. And how does it object what I said? In the case
> you are trying to add __print(2, 3) the 3rd one is *not* a variadic argument.
> If you make it to be variadic, I will agree with __print(2, 3). Before that
> it doesn't look right to me even if it works.

I addressed this in my first reply; the second parameter to `__print`
is *not* specific to variadic functions. It can just as well be used
for functions with a fixed number of arguments.