public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
From: Anderson Nascimento <anderson@allelesecurity.com>
To: Pengpeng Hou <pengpeng@iscas.ac.cn>,
	David Howells <dhowells@redhat.com>,
	Marc Dionne <marc.dionne@auristor.com>
Cc: Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Simon Horman <horms@kernel.org>,
	linux-afs@lists.infradead.org, netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH] rxrpc/proc: size address buffers for %pISpc output
Date: Sun, 5 Apr 2026 14:40:20 -0300	[thread overview]
Message-ID: <16f1456c-e540-4eca-a1c7-9d43a4b18539@allelesecurity.com> (raw)
In-Reply-To: <20260404190004.4-rxrpc-proc-pengpeng@iscas.ac.cn>


On 4/4/26 6:32 AM, Pengpeng Hou wrote:
> The AF_RXRPC procfs helpers format local and remote socket addresses into
> fixed 50-byte stack buffers with "%pISpc".
>
> That is too small for the longest IPv6-with-port form the formatter can
> produce: a compressed IPv6 address still permits a bracketed mapped-IPv4
> spelling plus the trailing port, which exceeds 50 bytes including the final
> NUL.
>
> Size the buffers from the formatters maximum textual form and switch the
> call sites to scnprintf().
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>   net/rxrpc/proc.c | 32 ++++++++++++++++++--------------
>   1 file changed, 18 insertions(+), 14 deletions(-)
>
> diff --git a/net/rxrpc/proc.c b/net/rxrpc/proc.c
> index 59292f7f9205..7925d4569776 100644
> --- a/net/rxrpc/proc.c
> +++ b/net/rxrpc/proc.c
> @@ -10,6 +10,10 @@
>   #include <net/af_rxrpc.h>
>   #include "ar-internal.h"
>   
> +#define RXRPC_PROC_ADDRBUF_SIZE \
> +	(sizeof("[xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255]") + \
> +	 sizeof(":12345"))
> +
>   static const char *const rxrpc_conn_states[RXRPC_CONN__NR_STATES] = {
>   	[RXRPC_CONN_UNUSED]			= "Unused  ",
>   	[RXRPC_CONN_CLIENT_UNSECURED]		= "ClUnsec ",
> @@ -53,7 +57,7 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
>   	struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
>   	enum rxrpc_call_state state;
>   	rxrpc_seq_t tx_bottom;
> -	char lbuff[50], rbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   	long timeout = 0;
>   
>   	if (v == &rxnet->calls) {
> @@ -69,11 +73,11 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
>   
>   	local = call->local;
>   	if (local)
> -		sprintf(lbuff, "%pISpc", &local->srx.transport);
> +		scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport);
>   	else
>   		strcpy(lbuff, "no_local");
>   
> -	sprintf(rbuff, "%pISpc", &call->dest_srx.transport);
> +	scnprintf(rbuff, sizeof(rbuff), "%pISpc", &call->dest_srx.transport);
>   
>   	state = rxrpc_call_state(call);
>   	if (state != RXRPC_CALL_SERVER_PREALLOC)
> @@ -142,7 +146,7 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
>   	struct rxrpc_connection *conn;
>   	struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
>   	const char *state;
> -	char lbuff[50], rbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   
>   	if (v == &rxnet->conn_proc_list) {
>   		seq_puts(seq,
> @@ -161,8 +165,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
>   		goto print;
>   	}
>   
> -	sprintf(lbuff, "%pISpc", &conn->local->srx.transport);
> -	sprintf(rbuff, "%pISpc", &conn->peer->srx.transport);
> +	scnprintf(lbuff, sizeof(lbuff), "%pISpc", &conn->local->srx.transport);
> +	scnprintf(rbuff, sizeof(rbuff), "%pISpc", &conn->peer->srx.transport);
>   print:
>   	state = rxrpc_is_conn_aborted(conn) ?
>   		rxrpc_call_completions[conn->completion] :
> @@ -228,7 +232,7 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v)
>   {
>   	struct rxrpc_bundle *bundle;
>   	struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
> -	char lbuff[50], rbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   
>   	if (v == &rxnet->bundle_proc_list) {
>   		seq_puts(seq,
> @@ -242,8 +246,8 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v)
>   
>   	bundle = list_entry(v, struct rxrpc_bundle, proc_link);
>   
> -	sprintf(lbuff, "%pISpc", &bundle->local->srx.transport);
> -	sprintf(rbuff, "%pISpc", &bundle->peer->srx.transport);
> +	scnprintf(lbuff, sizeof(lbuff), "%pISpc", &bundle->local->srx.transport);
> +	scnprintf(rbuff, sizeof(rbuff), "%pISpc", &bundle->peer->srx.transport);
>   	seq_printf(seq,
>   		   "UDP   %-47.47s %-47.47s %4x %3u %3d"
>   		   " %c%c%c %08x | %08x %08x %08x %08x %08x\n",
> @@ -279,7 +283,7 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v)
>   {
>   	struct rxrpc_peer *peer;
>   	time64_t now;
> -	char lbuff[50], rbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   
>   	if (v == SEQ_START_TOKEN) {
>   		seq_puts(seq,
> @@ -290,9 +294,9 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v)
>   
>   	peer = list_entry(v, struct rxrpc_peer, hash_link);
>   
> -	sprintf(lbuff, "%pISpc", &peer->local->srx.transport);
> +	scnprintf(lbuff, sizeof(lbuff), "%pISpc", &peer->local->srx.transport);
>   
> -	sprintf(rbuff, "%pISpc", &peer->srx.transport);
> +	scnprintf(rbuff, sizeof(rbuff), "%pISpc", &peer->srx.transport);
>   
>   	now = ktime_get_seconds();
>   	seq_printf(seq,
> @@ -401,7 +405,7 @@ const struct seq_operations rxrpc_peer_seq_ops = {
>   static int rxrpc_local_seq_show(struct seq_file *seq, void *v)
>   {
>   	struct rxrpc_local *local;
> -	char lbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   
>   	if (v == SEQ_START_TOKEN) {
>   		seq_puts(seq,
> @@ -412,7 +416,7 @@ static int rxrpc_local_seq_show(struct seq_file *seq, void *v)
>   
>   	local = hlist_entry(v, struct rxrpc_local, link);
>   
> -	sprintf(lbuff, "%pISpc", &local->srx.transport);
> +	scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport);
>   
>   	seq_printf(seq,
>   		   "UDP   %-47.47s %3u %3u %3u\n",

Do you have any evidence to confirm this issue? While the code could be 
improved, I don't see how that specific error would occur. Based on a 
quick experiment, the resulting string is at most 47 or 48 bytes (e.g., 
|[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]:65535|).

  reply	other threads:[~2026-04-05 17:40 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-04  9:32 [PATCH] rxrpc/proc: size address buffers for %pISpc output Pengpeng Hou
2026-04-05 17:40 ` Anderson Nascimento [this message]
2026-04-06  6:10 ` Pengpeng Hou
2026-04-06  4:12   ` Anderson Nascimento
2026-04-06  8:40 ` [PATCH v2] " Pengpeng Hou
2026-04-08  8:08   ` David Howells
2026-04-08  8:21   ` Pengpeng Hou
2026-04-08 11:40   ` David Howells
2026-04-06  9:00 ` [PATCH] " Pengpeng Hou

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=16f1456c-e540-4eca-a1c7-9d43a4b18539@allelesecurity.com \
    --to=anderson@allelesecurity.com \
    --cc=dhowells@redhat.com \
    --cc=edumazet@google.com \
    --cc=horms@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-afs@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marc.dionne@auristor.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=pengpeng@iscas.ac.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox