vsprintf: remove %n handling

All in-kernel users of %n in format strings have now been removed and
the %n directive is ignored.  Remove the handling of %n so that it is
treated the same as any other invalid format string directive.  Keep a
warning in place to deter new instances of %n in format strings.

Signed-off-by: Ryan Mallon <rmallon@gmail.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 5e2cf6f342f8cac5dad0d91481c0622c36542179..0648291cdafe8d6358914c5c2fa737c31d39704d 100644 (file)
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -364,7 +364,6 @@ enum format_type {
        FORMAT_TYPE_SHORT,
        FORMAT_TYPE_UINT,
        FORMAT_TYPE_INT,
-       FORMAT_TYPE_NRCHARS,
        FORMAT_TYPE_SIZE_T,
        FORMAT_TYPE_PTRDIFF
 };
@@ -1538,10 +1537,6 @@ qualifier:
                return fmt - start;
                /* skip alnum */
 
-       case 'n':
-               spec->type = FORMAT_TYPE_NRCHARS;
-               return ++fmt - start;
-
        case '%':
                spec->type = FORMAT_TYPE_PERCENT_CHAR;
                return ++fmt - start;
@@ -1564,6 +1559,15 @@ qualifier:
        case 'u':
                break;
 
+       case 'n':
+               /*
+                * Since %n poses a greater security risk than utility, treat
+                * it as an invalid format specifier. Warn about its use so
+                * that new instances don't get added.
+                */
+               WARN_ONCE(1, "Please remove ignored %%n in '%s'\n", fmt);
+               /* Fall-through */
+
        default:
                spec->type = FORMAT_TYPE_INVALID;
                return fmt - start;
@@ -1737,20 +1741,6 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                        ++str;
                        break;
 
-               case FORMAT_TYPE_NRCHARS: {
-                       /*
-                        * Since %n poses a greater security risk than
-                        * utility, ignore %n and skip its argument.
-                        */
-                       void *skip_arg;
-
-                       WARN_ONCE(1, "Please remove ignored %%n in '%s'\n",
-                                       old_fmt);
-
-                       skip_arg = va_arg(args, void *);
-                       break;
-               }
-
                default:
                        switch (spec.type) {
                        case FORMAT_TYPE_LONG_LONG:
@@ -2025,19 +2015,6 @@ do {                                                                     \
                                fmt++;
                        break;
 
-               case FORMAT_TYPE_NRCHARS: {
-                       /* skip %n 's argument */
-                       u8 qualifier = spec.qualifier;
-                       void *skip_arg;
-                       if (qualifier == 'l')
-                               skip_arg = va_arg(args, long *);
-                       else if (_tolower(qualifier) == 'z')
-                               skip_arg = va_arg(args, size_t *);
-                       else
-                               skip_arg = va_arg(args, int *);
-                       break;
-               }
-
                default:
                        switch (spec.type) {
 
@@ -2196,10 +2173,6 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
                        ++str;
                        break;
 
-               case FORMAT_TYPE_NRCHARS:
-                       /* skip */
-                       break;
-
                default: {
                        unsigned long long num;