From nobody Mon Apr 6 15:50:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33A5B40DFDF for ; Thu, 19 Mar 2026 00:27:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773880024; cv=none; b=bq99dGBH6V2LNSoG3UIJC3G8usz5mWTcngsgERmLfzmi4BkxdriIlvBz6IxMhbJKWVSjIv6TeuyulQQgAziNB4Cc3JFZMDHwpYxx0FWfoFNxopIhyUDXfn1LOkLVptwgPY6nG6WFZsS0oaCvOD5pviKj4si4v5QdeziZir45jxs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773880024; c=relaxed/simple; bh=/hkVghXwHYf1xeOY2nfgN8yMEeq7M4ZdPZr420JA6C8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=Sym6QAhm88hcmx3ij8Nz6mEdSaAuNWs0NBL1KXW0vbOBaCBuGqNigJRpnzUoz9SI2xU7nIALz4StIepUuxm2f3J340MfPapECiUDeIMx5tKpZWbNuiXAI6mKC+s0VBJgSpUGBaID3igmkpIjArpECapoj/HVEel+gjweU2Gnqjo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=eX0SVYEq; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="eX0SVYEq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43276C19421; Thu, 19 Mar 2026 00:27:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1773880023; bh=/hkVghXwHYf1xeOY2nfgN8yMEeq7M4ZdPZr420JA6C8=; h=From:To:Cc:Subject:Date:From; b=eX0SVYEqwY6pc8wwlSlTfJ9wAsgzXq+V3wQfvmTu0Vnb5NJ/z7X9rNYBbl7pX/cwN Md3/88EN1mhecQQuyp1qYPRMgs/Sf0hXcOPP6ravlz2srpzJFR/40e8deGX5cCatup 2ipquhIWoJJkaPgvRylBlHV27sCwSPXnKwAxVMhEMSrw+gCGIpgo0LdjHs51oZZxaB xz1tvbrd0EQGr9TI705cYgak9Qla2ES3NHUkFaI+bFJNmaGIORNUzU0OflUbeyNL62 KHd1m3fyjIAGWDvNjEgrxJRcmkr1C/3YbcljMXI+DI4L2jlDGQJuQ20e0FpB8Qgtnh J+a07LIRqnKIA== From: "Masami Hiramatsu (Google)" To: Petr Mladek , Steven Rostedt Cc: Andy Shevchenko , Rasmus Villemoes , Sergey Senozhatsky , Andrew Morton , linux-kernel@vger.kernel.org Subject: [PATCH] lib/vsprintf: Fix to check field_width and precision Date: Thu, 19 Mar 2026 09:26:59 +0900 Message-ID: <177388001976.19951.3455192731084870216.stgit@devnote2> X-Mailer: git-send-email 2.43.0 User-Agent: StGit/0.19 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Masami Hiramatsu (Google) Check the field_width and presition correctly. Previously it depends on the bitfield conversion from int to check out-of-range error. However, commit 938df695e98d ("vsprintf: associate the format state with the format pointer") changed those fields to int. We need to check the out-of-range correctly without bitfield conversion. Fixes: 938df695e98d ("vsprintf: associate the format state with the format = pointer") Reported-by: David Laight Closes: https://lore.kernel.org/all/20260318151250.40fef0ab@pumpkin/ Signed-off-by: Masami Hiramatsu (Google) --- lib/vsprintf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 800b8ac49f53..054c9758118e 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -2803,7 +2803,8 @@ static void set_field_width(struct printf_spec *spec, int width) { spec->field_width =3D width; - if (WARN_ONCE(spec->field_width !=3D width, "field width %d too large", w= idth)) { + if (WARN_ONCE(spec->field_width > FIELD_WIDTH_MAX || + spec->field_width < -FIELD_WIDTH_MAX, "field width %d too large", = width)) { spec->field_width =3D clamp(width, -FIELD_WIDTH_MAX, FIELD_WIDTH_MAX); } } @@ -2812,7 +2813,8 @@ static void set_precision(struct printf_spec *spec, int prec) { spec->precision =3D prec; - if (WARN_ONCE(spec->precision !=3D prec, "precision %d too large", prec))= { + if (WARN_ONCE(spec->precision > PRECISION_MAX || spec->precision < 0, + "precision %d too large", prec)) { spec->precision =3D clamp(prec, 0, PRECISION_MAX); } }