lib/vsprintf.c: handle invalid format specifiers more robustly

[linux-2.6-block.git] / lib / vsprintf.c

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 95cd63b43b99fa83798fb68dadfbd95a8c0bc57c..e35724c2b2a89b0ca0715b24114f314ac5ebf5e8 100644 (file)
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1448,6 +1448,9 @@ int kptr_restrict __read_mostly;
  * - 'Cn' For a clock, it prints the name (Common Clock Framework) or address
  *        (legacy clock framework) of the clock
  * - 'Cr' For a clock, it prints the current rate of the clock
+ * - 'n' For ignored argument
+ *
+ * ** Please update also Documentation/printk-formats.txt when making changes **
  *
  * Note: The difference between 'S' and 'F' is that on ia64 and ppc64
  * function pointers are really function descriptors, which contain a
@@ -1769,14 +1772,14 @@ qualifier:
 
        case 'n':
                /*
-                * Since %n poses a greater security risk than utility, treat
-                * it as an invalid format specifier. Warn about its use so
-                * that new instances don't get added.
+                * Since %n poses a greater security risk than
+                * utility, treat it as any other invalid or
+                * unsupported format specifier.
                 */
-               WARN_ONCE(1, "Please remove ignored %%n in '%s'\n", fmt);
                /* Fall-through */
 
        default:
+               WARN_ONCE(1, "Please remove unsupported %%%c in format string\n", *fmt);
                spec->type = FORMAT_TYPE_INVALID;
                return fmt - start;
        }
@@ -1812,40 +1815,13 @@ qualifier:
  * @args: Arguments for the format string
  *
  * This function follows C99 vsnprintf, but has some extensions:
- * %pS output the name of a text symbol with offset
- * %ps output the name of a text symbol without offset
- * %pF output the name of a function pointer with its offset
- * %pf output the name of a function pointer without its offset
- * %pB output the name of a backtrace symbol with its offset
- * %pR output the address range in a struct resource with decoded flags
- * %pr output the address range in a struct resource with raw flags
- * %pb output the bitmap with field width as the number of bits
- * %pbl output the bitmap as range list with field width as the number of bits
- * %pM output a 6-byte MAC address with colons
- * %pMR output a 6-byte MAC address with colons in reversed order
- * %pMF output a 6-byte MAC address with dashes
- * %pm output a 6-byte MAC address without colons
- * %pmR output a 6-byte MAC address without colons in reversed order
- * %pI4 print an IPv4 address without leading zeros
- * %pi4 print an IPv4 address with leading zeros
- * %pI6 print an IPv6 address with colons
- * %pi6 print an IPv6 address without colons
- * %pI6c print an IPv6 address as specified by RFC 5952
- * %pIS depending on sa_family of 'struct sockaddr *' print IPv4/IPv6 address
- * %piS depending on sa_family of 'struct sockaddr *' print IPv4/IPv6 address
- * %pU[bBlL] print a UUID/GUID in big or little endian using lower or upper
- *   case.
- * %*pE[achnops] print an escaped buffer
- * %*ph[CDN] a variable-length hex string with a separator (supports up to 64
- *           bytes of the input)
- * %pC output the name (Common Clock Framework) or address (legacy clock
- *     framework) of a clock
- * %pCn output the name (Common Clock Framework) or address (legacy clock
- *      framework) of a clock
- * %pCr output the current rate of a clock
  * %n is ignored
+ * %p* is handled by pointer()
+ *
+ * See pointer() or Documentation/printk-formats.txt for more
+ * extensive description.
  *
- * ** Please update Documentation/printk-formats.txt when making changes **
+ * ** Please update the documentation in both places when making changes **
  *
  * The return value is the number of characters which would
  * be generated for the given input, excluding the trailing
@@ -1944,10 +1920,15 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                        break;
 
                case FORMAT_TYPE_INVALID:
-                       if (str < end)
-                               *str = '%';
-                       ++str;
-                       break;
+                       /*
+                        * Presumably the arguments passed gcc's type
+                        * checking, but there is no safe or sane way
+                        * for us to continue parsing the format and
+                        * fetching from the va_list; the remaining
+                        * specifiers and arguments would be out of
+                        * sync.
+                        */
+                       goto out;
 
                default:
                        switch (spec.type) {
@@ -1992,6 +1973,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                }
        }
 
+out:
        if (size > 0) {
                if (str < end)
                        *str = '\0';
@@ -2189,9 +2171,10 @@ do {                                                                     \
 
                switch (spec.type) {
                case FORMAT_TYPE_NONE:
-               case FORMAT_TYPE_INVALID:
                case FORMAT_TYPE_PERCENT_CHAR:
                        break;
+               case FORMAT_TYPE_INVALID:
+                       goto out;
 
                case FORMAT_TYPE_WIDTH:
                case FORMAT_TYPE_PRECISION:
@@ -2253,6 +2236,7 @@ do {                                                                      \
                }
        }
 
+out:
        return (u32 *)(PTR_ALIGN(str, sizeof(u32))) - bin_buf;
 #undef save_arg
 }
@@ -2375,12 +2359,14 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
                        break;
 
                case FORMAT_TYPE_PERCENT_CHAR:
-               case FORMAT_TYPE_INVALID:
                        if (str < end)
                                *str = '%';
                        ++str;
                        break;
 
+               case FORMAT_TYPE_INVALID:
+                       goto out;
+
                default: {
                        unsigned long long num;
 
@@ -2423,6 +2409,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
                } /* switch(spec.type) */
        } /* while(*fmt) */
 
+out:
        if (size > 0) {
                if (str < end)
                        *str = '\0';