[PATCH 17/18] NAN: Drop dead error checks on the peer schedule dumps
Andrei Otcheretianski
andrei.otcheretianski at intel.com
Mon Oct 12 08:46:51 PDT 2026
wpa_scnprintf() and wpa_snprintf_hex() never return a negative value
and never return more than size - 1, so the os_snprintf_error() checks
that follow them can never fire. As a result the "buffer too small"
paths in the peer schedule and potential availability dumps were dead
code, and the functions could never actually return -1.
Drop the checks and accumulate the return values directly, and adjust
the documentation to state that the output is truncated rather than
rejected when the buffer is too small.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski at intel.com>
---
src/nan/nan_util.c | 122 ++++++++++++++++-----------------------------
1 file changed, 42 insertions(+), 80 deletions(-)
diff --git a/src/nan/nan_util.c b/src/nan/nan_util.c
index 3ea284cbd1..02d283fe46 100644
--- a/src/nan/nan_util.c
+++ b/src/nan/nan_util.c
@@ -1716,64 +1716,47 @@ static void nan_dump_tbm_to_buf(char **pos, char *end, const char *label,
* @buf: Output buffer
* @buflen: The length of &buf in bytes
*
- * Returns: The number of characters written to the buffer, or -1 on error,
- * which indicates that the buffer was too small.
+ * Returns: The number of characters written to the buffer. The output is
+ * truncated if the buffer is too small.
*/
int nan_peer_dump_sched_to_buf(struct nan_peer_schedule *sched,
char *buf, size_t buflen)
{
- int i, j, ret;
+ int i, j;
char *pos = buf;
char *end = buf + buflen;
for (i = 0; i < sched->n_maps; i++) {
struct nan_map *map = &sched->maps[i];
- ret = wpa_scnprintf(pos, end - pos,
- "MAP [%u]\n\tmap_id=%u\n\tn_chans=%u\n",
- i, map->map_id, map->n_chans);
- if (os_snprintf_error(end - pos, ret))
- goto err;
- pos += ret;
+ pos += wpa_scnprintf(pos, end - pos,
+ "MAP [%u]\n\tmap_id=%u\n\tn_chans=%u\n",
+ i, map->map_id, map->n_chans);
for (j = 0; j < map->n_chans; j++) {
struct nan_map_chan *chan = &map->chans[j];
- ret = wpa_scnprintf(pos, end - pos,
- "\tchannel[%u]: committed=%u rx_nss=%u freq=%u bw=%u cfreq1=%u cfreq2=%u\n",
- j, chan->committed, chan->rx_nss,
- chan->chan.freq,
- chan->chan.bandwidth,
- chan->chan.center_freq1,
- chan->chan.center_freq2);
- if (os_snprintf_error(end - pos, ret))
- goto err;
- pos += ret;
-
- ret = wpa_scnprintf(pos, end - pos,
- "\t\tbitmap: period=%u duration=%u offset=%u ",
- BIT(6 + chan->tbm.period),
- BIT(4 + chan->tbm.duration),
- 16 * chan->tbm.offset);
- if (os_snprintf_error(end - pos, ret))
- goto err;
- pos += ret;
-
- ret = wpa_scnprintf(pos, end - pos, "bitmap=");
- if (os_snprintf_error(end - pos, ret))
- goto err;
- pos += ret;
-
- ret = wpa_snprintf_hex(pos, end - pos, chan->tbm.bitmap,
- chan->tbm.len);
- if (os_snprintf_error(end - pos, ret))
- goto err;
- pos += ret;
-
- ret = wpa_scnprintf(pos, end - pos, "\n");
- if (os_snprintf_error(end - pos, ret))
- goto err;
- pos += ret;
+ pos += wpa_scnprintf(pos, end - pos,
+ "\tchannel[%u]: committed=%u rx_nss=%u freq=%u bw=%u cfreq1=%u cfreq2=%u\n",
+ j, chan->committed, chan->rx_nss,
+ chan->chan.freq,
+ chan->chan.bandwidth,
+ chan->chan.center_freq1,
+ chan->chan.center_freq2);
+
+ pos += wpa_scnprintf(pos, end - pos,
+ "\t\tbitmap: period=%u duration=%u offset=%u ",
+ BIT(6 + chan->tbm.period),
+ BIT(4 + chan->tbm.duration),
+ 16 * chan->tbm.offset);
+
+ pos += wpa_scnprintf(pos, end - pos, "bitmap=");
+
+ pos += wpa_snprintf_hex(pos, end - pos,
+ chan->tbm.bitmap,
+ chan->tbm.len);
+
+ pos += wpa_scnprintf(pos, end - pos, "\n");
}
nan_dump_tbm_to_buf(&pos, end, "ndc", &map->ndc);
@@ -1792,19 +1775,10 @@ int nan_peer_dump_sched_to_buf(struct nan_peer_schedule *sched,
nan_dump_tbm_to_buf(&pos, end, "immutable", &map->immutable);
}
- ret = wpa_scnprintf(pos, end - pos, "max_idle_period=%u",
- sched->max_idle_period);
-
- if (os_snprintf_error(end - pos, ret))
- goto err;
-
- pos += ret;
+ pos += wpa_scnprintf(pos, end - pos, "max_idle_period=%u",
+ sched->max_idle_period);
return pos - buf;
-
-err:
- wpa_printf(MSG_DEBUG, "NAN: Buffer too small to dump peer schedule");
- return -1;
}
@@ -1816,52 +1790,40 @@ err:
* @buf: Output buffer
* @buflen: Length of &buf in bytes
*
- * Returns: The number of characters written to the buffer, or -1 on error,
- * which indicates that the buffer was too small.
+ * Returns: The number of characters written to the buffer. The output is
+ * truncated if the buffer is too small.
*/
int nan_peer_dump_pot_avail_to_buf(struct nan_peer_potential_avail *pot_avail,
char *buf, size_t buflen)
{
unsigned int i, j;
- int ret;
char *pos = buf;
char *end = buf + buflen;
for (i = 0; i < pot_avail->n_maps; i++) {
struct pot_entry *pot = &pot_avail->maps[i];
- ret = wpa_scnprintf(pos, end - pos,
- "entry[%u]: rx_nss=%u pref=%u util=%u\n",
- i, pot->rx_nss, pot->preference,
- pot->utilization);
- if (os_snprintf_error(end - pos, ret))
- goto err;
- pos += ret;
+ pos += wpa_scnprintf(pos, end - pos,
+ "entry[%u]: rx_nss=%u pref=%u util=%u\n",
+ i, pot->rx_nss, pot->preference,
+ pot->utilization);
for (j = 0; j < pot->n_band_chan; j++) {
- if (pot->is_band) {
- ret = wpa_scnprintf(pos, end - pos,
- "\tband[%u]: band_id=%u\n",
- j, pot->entries[j].band_id);
- } else {
- ret = wpa_scnprintf(
+ if (pot->is_band)
+ pos += wpa_scnprintf(pos, end - pos,
+ "\tband[%u]: band_id=%u\n",
+ j,
+ pot->entries[j].band_id);
+ else
+ pos += wpa_scnprintf(
pos, end - pos,
"\tchan[%u]: op_class=%u chan_bitmap=0x%04x\n",
j, pot->entries[j].op_class,
pot->entries[j].chan_bitmap);
- }
- if (os_snprintf_error(end - pos, ret))
- goto err;
- pos += ret;
}
}
return pos - buf;
-
-err:
- wpa_printf(MSG_DEBUG,
- "NAN: Buffer too small to dump peer potential availability");
- return -1;
}
--
2.53.0
More information about the Hostap
mailing list