sscanf linux kernel differs from sscanf glibc - c

Question

Running the following code (make runtest) on my machine (4.6.4-1-ARCH)
/* scanf userland & kernelspace test */
#if __KERNEL__
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/string.h>
MODULE_AUTHOR("Enteee (duckpond.ch) ");
MODULE_DESCRIPTION("scanf test");
MODULE_LICENSE("GPL");
MODULE_ALIAS("scanf_test");
#else
#include <stdio.h>
#include <string.h>
#define printk printf
#endif
void test(void){
int ret = 0;
char fp[20] = { 0 };
memset(fp, 0xaa, sizeof(fp));
printk("init, ret = %d fp = "
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx"
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx"
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx"
"%2.2hhx%2.2hhx, "
// overflow prints (hacky)
"after fp = "
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx, "
"before fp = "
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx"
"\n",
ret,
(fp)[0], (fp)[1], (fp)[2], (fp)[3], (fp)[4], (fp)[5],
(fp)[6], (fp)[7], (fp)[8], (fp)[9], (fp)[10], (fp)[11],
(fp)[12], (fp)[13], (fp)[14], (fp)[15], (fp)[16], (fp)[17],
(fp)[18], (fp)[19],
// overflow
(fp)[20], (fp)[21], (fp)[22], (fp)[23], (fp)[24], (fp)[25],
(fp)[-1], (fp)[-2], (fp)[-3], (fp)[-4], (fp)[-5], (fp)[-6]
);
ret = sscanf("aabb", "%2hhx%2hhx", &fp[0], &fp[1]);
printk("ret = %d fp = %2.2hhx%2.2hhx\n", ret, fp[0], fp[1]);
ret = sscanf(
"ffffffffffffffffffffffffffffffffffffffff",
"%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx"
"%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx"
"%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx"
"%2hhx%2hhx",
&(fp)[0], &(fp)[1], &(fp)[2], &(fp)[3], &(fp)[4], &(fp)[5],
&(fp)[6], &(fp)[7], &(fp)[8], &(fp)[9], &(fp)[10], &(fp)[11],
&(fp)[12], &(fp)[13], &(fp)[14], &(fp)[15], &(fp)[16], &(fp)[17],
&(fp)[18], &(fp)[19]
);
printk("ret = %d fp = "
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx"
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx"
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx"
"%2.2hhx%2.2hhx, "
// overflow prints (hacky)
"after fp = "
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx, "
"before fp = "
"%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx%2.2hhx"
"\n",
ret,
(fp)[0], (fp)[1], (fp)[2], (fp)[3], (fp)[4], (fp)[5],
(fp)[6], (fp)[7], (fp)[8], (fp)[9], (fp)[10], (fp)[11],
(fp)[12], (fp)[13], (fp)[14], (fp)[15], (fp)[16], (fp)[17],
(fp)[18], (fp)[19],
(fp)[20], (fp)[21], (fp)[22], (fp)[23], (fp)[24], (fp)[25],
(fp)[-1], (fp)[-2], (fp)[-3], (fp)[-4], (fp)[-5], (fp)[-6]
);
}
#ifndef __KERNEL__
int main(void){
test();
return 0;
}
#else
static int __init test_init(void) {
test();
return 0;
}
static void __exit test_exit(void) {
}
module_init(test_init);
module_exit(test_exit);
#endif
yields:
=== user space ===
init, ret = 0 fp = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa, after fp = 65005f5f7664, before fp = 000000000000
ret = 2 fp = aabb
ret = 20 fp = ffffffffffffffffffffffffffffffffffffffff, after fp = 65005f5f7664, before fp = 000000000000
=== kernel space ===
[386177.161037] init, ret = 0 fp = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa, after fp = baae0dbc0000, before fp = bc0daebaffff
[386177.161044] ret = 2 fp = aabb
[386177.161061] ret = 20 fp = 000000000000000000000000ffffffffffffffff, after fp = baae0dbc0000, before fp = bc0daebaffff
The test.c basically reads ffffffffffffffffffffffffffffffffffffffff to fp using sscanf with a sequence of %2hhx format specifiers. After that, it prints fp using printf / printk with a sequence of %2.2hhx format specifiers.
Can somebody explain me why fp is no the same when read with glibc sscanf and linux sscanf. In addition, why is the aabb-test working just fine?
I already checked the linux sscanf impelmentation and from what I can see it should be similar to the glibc sscanf.
I do think I'm missing the obvious here..
Notes:
the gist containing the Makefile can be found here
this is just an example, please don't tell me that this is an ugly implementation. There are even 24 invalid reads! thx, I'm aware of that.