Re: [RFC PATCH 1/1] lib/vsprintf: Limit the returning size to INT_MAX

[David Laight]

On Wed, 18 Mar 2026 09:47:33 -0400
Steven Rostedt <rostedt@xxxxxxxxxxx> wrote:

> On Wed, 18 Mar 2026 10:19:56 +0900
> "Masami Hiramatsu (Google)" <mhiramat@xxxxxxxxxx> wrote:
> 
> > From: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
> > 
> > There seems a design flaw of vsnprintf() whose return value can
> > overflow the INT_MAX even on 32bit arch, because the buffer size is
> > passed by 'size_t' but it returns the printed or required size in 'int'.
> > 
> > The size_t is unsigned long, thus the caller can pass bigger than INT_MAX
> > as the size of buffer (that is OK). But even the vsnprintf calculates
> > the required/printed length correctly, if it overflows the INT_MAX,
> > it can not return the size correctly by int.
> > 
> > This should never happen but it should be checked and limited.
> > 
> > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
> > ---
> >  drivers/firmware/efi/libstub/vsprintf.c |    2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/firmware/efi/libstub/vsprintf.c b/drivers/firmware/efi/libstub/vsprintf.c
> > index 71c71c222346..1713cacecc25 100644
> > --- a/drivers/firmware/efi/libstub/vsprintf.c
> > +++ b/drivers/firmware/efi/libstub/vsprintf.c
> > @@ -549,7 +549,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list ap)
> >  	if (size)
> >  		buf[min(pos, size-1)] = '\0';
> >  
> > -	return pos;
> > +	return (pos > INT_MAX) ? INT_MAX : pos;
> >  }
> >  
> >  int snprintf(char *buf, size_t size, const char *fmt, ...)  
> 
> Since this would require a buffer of size greater than 2G to be passed in,
> I highly doubt this would happen anywhere in the kernel.
> 
> If anything, it would be for "correctness" only, but I don't see this ever
> being an issue within this century.

What about the return value (on 32bit) from:
	snprintf(NULL, 0, " %*s %*s ", INT_MAX, "", INT_MAX, "");

This is more of a problem for libc.

In reality there are easier ways to crash the kernel....

	David


> 
> -- Steve
>