From 26f923c7cff1a46d465efcd3b8f2240523c7ab08 Mon Sep 17 00:00:00 2001
From: Evgeny Bachinin <EABachinin@sberdevices.ru>
Date: Mon, 20 Mar 2023 11:23:11 +0300
Subject: [PATCH] cli: run_commandf(): small fixups
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

* vsnprintf() can truncate cmd, hence it makes no sense to launch such
command (it's broken). Moreover, it's better to signalize to the caller
about such case (for facilitating debugging or bug hunting).

* Fix kernel-doc warnings:
  include/command.h:264: info: Scanning doc for run_commandf
  include/command.h:268: warning: contents before sections
  include/command.h:271: warning: No description found for return value
                                  of 'run_commandf'

* Add printf-like format attribute to validate at compile-time the format
string against parameters's type.

* Fix compilation error in case of -Wall, -Werror, -Wextra:
error: variable ‘i’ set but not used [-Werror=unused-but-set-variable]

* Drop extra ret variable.

Signed-off-by: Evgeny Bachinin <EABachinin@sberdevices.ru>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 common/cli.c      | 25 +++++++++++++++++++------
 include/command.h | 13 ++++++++++---
 2 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/common/cli.c b/common/cli.c
index 9451e6a142..3916a7b10a 100644
--- a/common/cli.c
+++ b/common/cli.c
@@ -8,6 +8,8 @@
  * JinHua Luo, GuangDong Linux Center, <luo.jinhua@gd-linux.com>
  */
 
+#define pr_fmt(fmt) "cli: %s: " fmt, __func__
+
 #include <common.h>
 #include <bootstage.h>
 #include <cli.h>
@@ -20,6 +22,7 @@
 #include <malloc.h>
 #include <asm/global_data.h>
 #include <dm/ofnode.h>
+#include <linux/errno.h>
 
 #ifdef CONFIG_CMDLINE
 /*
@@ -129,16 +132,26 @@ int run_command_list(const char *cmd, int len, int flag)
 int run_commandf(const char *fmt, ...)
 {
 	va_list args;
-	char cmd[128];
-	int i, ret;
+	int nbytes;
 
 	va_start(args, fmt);
-	i = vsnprintf(cmd, sizeof(cmd), fmt, args);
+	/*
+	 * Limit the console_buffer space being used to CONFIG_SYS_CBSIZE,
+	 * because its last byte is used to fit the replacement of \0 by \n\0
+	 * in underlying hush parser
+	 */
+	nbytes = vsnprintf(console_buffer, CONFIG_SYS_CBSIZE, fmt, args);
 	va_end(args);
 
-	ret = run_command(cmd, 0);
-
-	return ret;
+	if (nbytes < 0) {
+		pr_debug("I/O internal error occurred.\n");
+		return -EIO;
+	} else if (nbytes >= CONFIG_SYS_CBSIZE) {
+		pr_debug("'fmt' size:%d exceeds the limit(%d)\n",
+			 nbytes, CONFIG_SYS_CBSIZE);
+		return -ENOSPC;
+	}
+	return run_command(console_buffer, 0);
 }
 
 /****************************************************************************/
diff --git a/include/command.h b/include/command.h
index 1b018cb98e..c4e3170967 100644
--- a/include/command.h
+++ b/include/command.h
@@ -13,6 +13,8 @@
 #include <env.h>
 #include <linker_lists.h>
 
+#include <linux/compiler_attributes.h>
+
 #ifndef NULL
 #define NULL	0
 #endif
@@ -260,12 +262,17 @@ int run_command_repeatable(const char *cmd, int flag);
 /**
  * run_commandf() - Run a command created by a format string
  *
- * The command cannot be larger than 127 characters
- *
  * @fmt: printf() format string
  * @...: Arguments to use (flag is always 0)
+ *
+ * The command cannot be larger than (CONFIG_SYS_CBSIZE - 1) characters.
+ *
+ * Return:
+ * Returns 0 on success, -EIO if internal output error occurred, -ENOSPC in
+ *	case of 'fmt' string truncation, or != 0 on error, specific for
+ *	run_command().
  */
-int run_commandf(const char *fmt, ...);
+int run_commandf(const char *fmt, ...) __printf(1, 2);
 
 /**
  * Run a list of commands separated by ; or even \0
-- 
2.39.5