From nobody Fri Apr 3 02:56:38 2026 Received: from sender-of-o57.zoho.eu (sender-of-o57.zoho.eu [136.143.169.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C8F893C5DB6 for ; Tue, 24 Mar 2026 22:50:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.169.57 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392617; cv=pass; b=JiMk7orN+eN6MPUZBZXxlvhYA2/HiooNFF6wpNXuGBIw1OIkGXmJfffemm3d+tZ9WcHBE9iNc5i0jaqYhFycaRqPrAZQRaDNMwAgSzE/k3LISFXvKtJwG1O9oE0L/+AkiANjJdamdzteQ1eRKvjre7vOF5q+Zo1lPB+J/l2aNUY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392617; c=relaxed/simple; bh=Zb+DD/8aPIY9FcDPOazctNoof0ZotU7WyO7WyK2XV9A=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=s7w25sTWmme7uYvrHZ3BPO1LzgEFKwiEZdWuOY0gOMx0K0/OVME63TBsv+zRKj846Syx4Yz9yhQK3nQ7qxT109sIL1tauaPJ8tpDzIya2PSGX3M+/tjlIhIrBDY72UZAH6PVbDG0LnHX/EjKE7F1BjfxJnGUMGAWUx5pNDaiaDE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org; spf=pass smtp.mailfrom=objecting.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b=dM/97SYX; arc=pass smtp.client-ip=136.143.169.57 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=objecting.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b="dM/97SYX" ARC-Seal: i=1; a=rsa-sha256; t=1774392584; cv=none; d=zohomail.eu; s=zohoarc; b=csKRhv9CzVohcq8gUme8e6TfNU0D8oHglFbtP4iTJmrOnJXxRemr1WnDV0lP/RaCGNtaaFRNfZMo90PlFBPfrG38+YiVWj/aByWviOHFOWMu5Ck9AobiphdwHttMv6tl3XFkcX7WBSKXCQV4Sf6s8vWFERq4xZ8noNVZab8j6XI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1774392584; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=Rwl7GglhzJT2BAuJqF7KW6FMwMdHiz/ULto5LIlyZGk=; b=epIly9tCFQ15p9A+3WEu9PHfBM6Kgu43F52hhvj3JD25WoCiBAAe/MQDQ216foY84EvIE9B7u6TKqYL/l0Hw+GlSIoOtsmpZaoLxLHGnANwycRbWfSLDr8z+0EqIkPldRRHqg+AFNI2llr3KjbzBE9bkph+065swfHrg/KdPD8g= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=objecting.org; spf=pass smtp.mailfrom=objecting@objecting.org; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1774392584; s=zmail; d=objecting.org; i=objecting@objecting.org; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-Id:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Reply-To; bh=Rwl7GglhzJT2BAuJqF7KW6FMwMdHiz/ULto5LIlyZGk=; b=dM/97SYXoRifC5WMSvwlcipUImLDUv/s1lwM3iNo5o8FvHpWCxFEZTF+RZAi1YfX fPvs9CxvEr2af3dX2ipvvMR5JL4V7H/p3cLfKOpgHkgQAsp2Ulw/eHL4TlB31AJxUIf 79EoWbIQWGUZI8xeGZIYW+Qel+dDEykHgg/jQzW4= Received: by mx.zoho.eu with SMTPS id 1774392582384220.1921176354116; Tue, 24 Mar 2026 23:49:42 +0100 (CET) From: Josh Law To: Petr Mladek , Steven Rostedt Cc: Andy Shevchenko , Rasmus Villemoes , Sergey Senozhatsky , Andrew Morton , Josh Law , linux-kernel@vger.kernel.org Subject: [PATCH 1/4] lib/vsprintf: always advance args in bstr_printf() pointer path Date: Tue, 24 Mar 2026 22:49:37 +0000 Message-Id: <20260324224940.50508-2-objecting@objecting.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260324224940.50508-1-objecting@objecting.org> References: <20260324224940.50508-1-objecting@objecting.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" When the output buffer is full (str >=3D end), bstr_printf() skips advancing the args pointer past the pre-rendered pointer string in bin_buf. This causes all subsequent format specifiers to read from the wrong position, corrupting the rest of the output. Always compute the string length and advance args regardless of whether there is space to copy into the output buffer. Signed-off-by: Josh Law Reviewed-by: Petr Mladek --- lib/vsprintf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 800b8ac49f53..7898fb998b21 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -3389,14 +3389,15 @@ int bstr_printf(char *buf, size_t size, const char = *fmt_str, const u32 *bin_buf) break; } /* Pointer dereference was already processed */ + len =3D strlen(args); if (str < end) { - len =3D copy =3D strlen(args); + copy =3D len; if (copy > end - str) copy =3D end - str; memcpy(str, args, copy); - str +=3D len; - args +=3D len + 1; } + str +=3D len; + args +=3D len + 1; } if (process) str =3D pointer(fmt.str, str, end, get_arg(void *), spec); --=20 2.34.1 From nobody Fri Apr 3 02:56:38 2026 Received: from sender-of-o57.zoho.eu (sender-of-o57.zoho.eu [136.143.169.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7501C3C5DBB for ; Tue, 24 Mar 2026 22:50:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.169.57 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392624; cv=pass; b=tXL0LQ23qNIPHIjzqrro02XBaUn1V5LpTHB3ya9PHzsulyH/1E8bGp52qtEH1dOdm8EPMSFCXyhfk1RIzVYO87NfyK09d+WS1L7aj3PA9LZ+6DoXoXBTz3flX7PZQJto2pY9b5RuqwVNgrlCR+MI3r2m0M3xLUTuMtk2ROfNIck= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392624; c=relaxed/simple; bh=/jX0D+33NUHGgBEM2k/7Y9W0NyRLJ4LXot3399eNdE0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=uE2BN66Ek40G5euAwVW07+Hj3wXcD/2au4UOVa+T4Eg1k+/3uvaTqI1Fv+Xrw83Ea2br1sMcD/xBnurMW3Tymt7RHIgBfNhFos/4fMtBDW0OSB+XOsXK1vj/vxh6YW6omdiMP+X5s3Nc5ZA12FdIntALH5AC5UAPsOm1tDJlOmQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org; spf=pass smtp.mailfrom=objecting.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b=eHxEnFMm; arc=pass smtp.client-ip=136.143.169.57 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=objecting.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b="eHxEnFMm" ARC-Seal: i=1; a=rsa-sha256; t=1774392585; cv=none; d=zohomail.eu; s=zohoarc; b=IISazmoMRfKdJt56DNqX30HA4dFnmK1gV8OXrbrSYFN22xNNnf9wpotz5gZTvuVAU3lPSK+lcKLfC0/l1dAFjnNvDdlYa/CMsmB2ZkUQaGkT/hpI5gQ8zNvpGnm2gavAw5KB558QypNUks0inq9QGuKPaEJv8R4InDd/URXAfT0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1774392585; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=4lvJu8mTYc831qvqwbt15ZPA0/Qf6sOrkpF7oTDTbRE=; b=XBvtg4lJo8wR2xTA3VBjFo8UmG9kibS2F19Lio1QA0NwfKOUavQ0G54GrkCdkD+pgFKVOCNxOmvlI92ViVahFE7xmssEnuET7ZP7jraV7bgN20HpPAanBott5jmzpz84AtuwOBBGWtonyLqFWU03bWbE0nyUBSXbT1cMSDlbvDE= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=objecting.org; spf=pass smtp.mailfrom=objecting@objecting.org; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1774392585; s=zmail; d=objecting.org; i=objecting@objecting.org; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-Id:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Reply-To; bh=4lvJu8mTYc831qvqwbt15ZPA0/Qf6sOrkpF7oTDTbRE=; b=eHxEnFMm6TtI6azRYivrQ3+dtBf0fvYpoIvUQ2k41HlkqI8QVhyWfS7FofP3Y+Jk 32sx1w7UM5mosbABP8UsAZoZTgc4JWpVYYo4tS+0Snf4h/skOUGAWrah4RfKTEfd7Lx fpXBS9tZ6cnSg99lNqtJP8I/N9X5xFLfjff3hPR4= Received: by mx.zoho.eu with SMTPS id 1774392583116445.98965947533577; Tue, 24 Mar 2026 23:49:43 +0100 (CET) From: Josh Law To: Petr Mladek , Steven Rostedt Cc: Andy Shevchenko , Rasmus Villemoes , Sergey Senozhatsky , Andrew Morton , Josh Law , linux-kernel@vger.kernel.org Subject: [PATCH 2/4] lib/vsprintf: fix OOB write in vbin_printf() when size is zero Date: Tue, 24 Mar 2026 22:49:38 +0000 Message-Id: <20260324224940.50508-3-objecting@objecting.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260324224940.50508-1-objecting@objecting.org> References: <20260324224940.50508-1-objecting@objecting.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" When vbin_printf() is called with size=3D=3D0, end equals bin_buf and the else branch writes end[-1], which is one byte before the buffer. Guard the write so it only happens when the buffer is non-empty. Signed-off-by: Josh Law Reviewed-by: Petr Mladek --- lib/vsprintf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 7898fb998b21..72fbfe181076 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -3234,7 +3234,7 @@ int vbin_printf(u32 *bin_buf, size_t size, const char= *fmt_str, va_list args) spec); if (str + 1 < end) *str++ =3D '\0'; - else + else if (end > (char *)bin_buf) end[-1] =3D '\0'; /* Must be nul terminated */ } /* skip all alphanumeric pointer suffixes */ --=20 2.34.1 From nobody Fri Apr 3 02:56:38 2026 Received: from sender-of-o57.zoho.eu (sender-of-o57.zoho.eu [136.143.169.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D18C13B4E8A for ; Tue, 24 Mar 2026 22:50:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.169.57 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392605; cv=pass; b=E8eHS3Xls1IJF2MEFrUOe7SKh8k/HstV4jhhYpul6DrQWLdJW4L3YuUupM8oEeCNnso7HKcrDQetRMtJeJcZpqUIIldz/oYV7Ksez2Xh8mkY2kaKBSONkN3/FjZfYJNKRBD92yleGCPtSquXaeibuLxuSyo1brCJb9tnKS6GI2c= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392605; c=relaxed/simple; bh=381OzBAHNU6Gnk/0LcZxfMCftsqVgY08k7T2TQ41kQM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=qWlNi/EeWPmSyt8O/UlxBnWl2+cifbioSIgqWlWjgk1Kzd6E3PnXigVoZZZmTdKvFj72HLWZ0wdEldKjW2WaB/yN2l6EnEGYwbNchxwzYMqwNKIInCy1HDY3z3MEw9uaI3NRIw6QKJFZxmdtl0CR8XgpG6/D0rfdp86O2CoT57c= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org; spf=pass smtp.mailfrom=objecting.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b=im6N4qJH; arc=pass smtp.client-ip=136.143.169.57 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=objecting.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b="im6N4qJH" ARC-Seal: i=1; a=rsa-sha256; t=1774392586; cv=none; d=zohomail.eu; s=zohoarc; b=kgP4OjDxKWw2fwE3QDuZr5CUsraendmRzvW0Fh2OJMHHgnt9B9Geq1fNxm4ewdgcSo4T2LqWnOy8ATacifubwEN92g3iXeZeQpOtWTGK7Lq0tFwF8tj3fmDB9hteo1pQcPHn2Pjy8a14WKgyLYDPs/iA0xEMyjCQkZ9jCti1Eh4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1774392586; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=it7ESxifSW6G9nwkeX2KYNbIZY0OPzW+aY8u8fff+yA=; b=eAouS2rXvlC83r+FW78Aa0cY450AznUFvNLFMW1CLonPxyVb31xC+9UlNyjKzek+movtfe9b4H+AsIWI/t0Y5SMv75hNiNUCGyc+EABA2LUqU3Otpm4P8YNMzfxRRIiCuBXuCmpqh1gGRXeO4pNaLOm4H/ElvBRZKOBT5e3cYvk= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=objecting.org; spf=pass smtp.mailfrom=objecting@objecting.org; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1774392586; s=zmail; d=objecting.org; i=objecting@objecting.org; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-Id:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Reply-To; bh=it7ESxifSW6G9nwkeX2KYNbIZY0OPzW+aY8u8fff+yA=; b=im6N4qJH1HWrShgZEtzwbxFQU4pYkCQwMj/vITfLGyLX1KMOUFa1cuORazP+ynNK tZIQHh/imTzh9+rYWShKsZD2JYX/tlpYODUs0ZfuCRpawRNZusT7KX3AFKm2KrEQWUN UWcj8Eblt/RsJaMiaz9DRGK71iPQmTJYiPH7mvtI= Received: by mx.zoho.eu with SMTPS id 1774392583848384.51608470602775; Tue, 24 Mar 2026 23:49:43 +0100 (CET) From: Josh Law To: Petr Mladek , Steven Rostedt Cc: Andy Shevchenko , Rasmus Villemoes , Sergey Senozhatsky , Andrew Morton , Josh Law , linux-kernel@vger.kernel.org Subject: [PATCH 3/4] lib/vsprintf: use int for field_width in vsscanf() Date: Tue, 24 Mar 2026 22:49:39 +0000 Message-Id: <20260324224940.50508-4-objecting@objecting.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260324224940.50508-1-objecting@objecting.org> References: <20260324224940.50508-1-objecting@objecting.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" vsscanf() declares field_width as s16 but assigns it from skip_atoi() which returns int. Values above 32767 silently truncate to negative, causing vsscanf() to abort all remaining parsing. This is inconsistent with struct printf_spec which uses int for field_width. Change the type to int to match. Signed-off-by: Josh Law --- lib/vsprintf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 72fbfe181076..2758096b6f53 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -3461,7 +3461,7 @@ int vsscanf(const char *buf, const char *fmt, va_list= args) long long s; unsigned long long u; } val; - s16 field_width; + int field_width; bool is_sign; =20 while (*fmt) { --=20 2.34.1 From nobody Fri Apr 3 02:56:38 2026 Received: from sender-of-o57.zoho.eu (sender-of-o57.zoho.eu [136.143.169.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 799F03C661A for ; Tue, 24 Mar 2026 22:50:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.169.57 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392607; cv=pass; b=LA4S0g9amkRd7crLhpC6D7OG/DDV+x4PeNZZdBF8iPKOD9TKOkNEMFbjC3IOinGLdCDWK8uaLEyHfOadfx62Kk1VgrnYp3brn55zHkHJtn6BZwsYHD7OQT8LsmA+96Ks+XFDIgjyFJPqXKadOD45U6s+yK3nY0HNu9ZT7mpkyak= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392607; c=relaxed/simple; bh=am/4VLcWn88b1bLHwF/f8ujUH7aNOLv3dRMBmZsdkbY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Ik4C3uGlgRx0T70lYDyjUH/47cPSFnsJEkwyUC4KLR+YAUpX7V+/XgV1laAp6xTVMV26G9jP6jQydgSXyd2wGucEr2vMW61VTYsgV128cQ9IdwdlTK/V9aRWSl1Y4FvtPbUC+ivTgx1IRfpz70/g1OLXZwfaj9kp59AMFQhMnqw= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org; spf=pass smtp.mailfrom=objecting.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b=c+XhVlWx; arc=pass smtp.client-ip=136.143.169.57 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=objecting.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b="c+XhVlWx" ARC-Seal: i=1; a=rsa-sha256; t=1774392587; cv=none; d=zohomail.eu; s=zohoarc; b=EWDSWL7JnWBUtaStb8oRzO9efRUA4ATImKkSTpfqNZx2MCtY/1jmCxLr2/Vooz6lvmgoiYs5zdCP1u7fPMwAhKDcAWry36HbCe0Kq9ztFGIeh4pZOXa/1hkDQi1XcYvE83pluQwQJdgXT300vGkp3a2gmX4JKnR1SSIFVLCYjpA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1774392587; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=hpAx/CxrdoyTqN0RJwcDfVSnJbT6nC9KChGUnTYyJw4=; b=YxOHxJDkpNpF3vfYEQlcd6m43YUZxGnKhKzt+/ueXUOg+R5rZNdIxTwdsOYRNvNktGuo2ak8f/sGusm5+jsM/tJmi1iTE6ugWhXLkhzsMZApHcc64E4QS7ps0EmeWjVO7rQE0fNr7sip0i9UfyvLe55LvXVhaFjOXOBzvAH3cNI= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=objecting.org; spf=pass smtp.mailfrom=objecting@objecting.org; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1774392587; s=zmail; d=objecting.org; i=objecting@objecting.org; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-Id:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Reply-To; bh=hpAx/CxrdoyTqN0RJwcDfVSnJbT6nC9KChGUnTYyJw4=; b=c+XhVlWx35TCstNwDFZ0e+4MSgalopN08Jm0hH8hRMl5Nv0lZrLySE3J+ABfScUl wFUxs9/bvoTmQ+p2gTs7wHMSkQvOykiCB6UtTi/DhckGk8XhzH+zHiKXw/Hf4Tn4PNO L0smIHBW+dSoor73Jqn/uLxitjy/kMxbXg7FfA3g= Received: by mx.zoho.eu with SMTPS id 1774392584546169.5722630441012; Tue, 24 Mar 2026 23:49:44 +0100 (CET) From: Josh Law To: Petr Mladek , Steven Rostedt Cc: Andy Shevchenko , Rasmus Villemoes , Sergey Senozhatsky , Andrew Morton , Josh Law , linux-kernel@vger.kernel.org Subject: [PATCH 4/4] lib/vsprintf: add missing (u8) cast in format_decode() lookup Date: Tue, 24 Mar 2026 22:49:40 +0000 Message-Id: <20260324224940.50508-5-objecting@objecting.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260324224940.50508-1-objecting@objecting.org> References: <20260324224940.50508-1-objecting@objecting.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" The first lookup into the format_state table correctly casts to (u8) at line 2778, but the second lookup after consuming a length qualifier does not. On signed-char platforms, a byte >=3D 0x80 sign-extends to a negative index, reading before the array. Add the same (u8) cast for consistency. Signed-off-by: Josh Law Reviewed-by: Petr Mladek --- lib/vsprintf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 2758096b6f53..3108823e8c22 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -2783,7 +2783,7 @@ struct fmt format_decode(struct fmt fmt, struct print= f_spec *spec) fmt.str++; } fmt.str++; - p =3D lookup_state + *fmt.str; + p =3D lookup_state + (u8)*fmt.str; } if (p->state) { if (p->base) --=20 2.34.1