From: Anderson Nascimento <anderson@allelesecurity.com>
To: Pengpeng Hou <pengpeng@iscas.ac.cn>,
David Howells <dhowells@redhat.com>,
Marc Dionne <marc.dionne@auristor.com>
Cc: Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
linux-afs@lists.infradead.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] rxrpc/proc: size address buffers for %pISpc output
Date: Sun, 5 Apr 2026 14:40:20 -0300 [thread overview]
Message-ID: <16f1456c-e540-4eca-a1c7-9d43a4b18539@allelesecurity.com> (raw)
In-Reply-To: <20260404190004.4-rxrpc-proc-pengpeng@iscas.ac.cn>
On 4/4/26 6:32 AM, Pengpeng Hou wrote:
> The AF_RXRPC procfs helpers format local and remote socket addresses into
> fixed 50-byte stack buffers with "%pISpc".
>
> That is too small for the longest IPv6-with-port form the formatter can
> produce: a compressed IPv6 address still permits a bracketed mapped-IPv4
> spelling plus the trailing port, which exceeds 50 bytes including the final
> NUL.
>
> Size the buffers from the formatters maximum textual form and switch the
> call sites to scnprintf().
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> net/rxrpc/proc.c | 32 ++++++++++++++++++--------------
> 1 file changed, 18 insertions(+), 14 deletions(-)
>
> diff --git a/net/rxrpc/proc.c b/net/rxrpc/proc.c
> index 59292f7f9205..7925d4569776 100644
> --- a/net/rxrpc/proc.c
> +++ b/net/rxrpc/proc.c
> @@ -10,6 +10,10 @@
> #include <net/af_rxrpc.h>
> #include "ar-internal.h"
>
> +#define RXRPC_PROC_ADDRBUF_SIZE \
> + (sizeof("[xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255]") + \
> + sizeof(":12345"))
> +
> static const char *const rxrpc_conn_states[RXRPC_CONN__NR_STATES] = {
> [RXRPC_CONN_UNUSED] = "Unused ",
> [RXRPC_CONN_CLIENT_UNSECURED] = "ClUnsec ",
> @@ -53,7 +57,7 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
> struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
> enum rxrpc_call_state state;
> rxrpc_seq_t tx_bottom;
> - char lbuff[50], rbuff[50];
> + char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
> long timeout = 0;
>
> if (v == &rxnet->calls) {
> @@ -69,11 +73,11 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
>
> local = call->local;
> if (local)
> - sprintf(lbuff, "%pISpc", &local->srx.transport);
> + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport);
> else
> strcpy(lbuff, "no_local");
>
> - sprintf(rbuff, "%pISpc", &call->dest_srx.transport);
> + scnprintf(rbuff, sizeof(rbuff), "%pISpc", &call->dest_srx.transport);
>
> state = rxrpc_call_state(call);
> if (state != RXRPC_CALL_SERVER_PREALLOC)
> @@ -142,7 +146,7 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
> struct rxrpc_connection *conn;
> struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
> const char *state;
> - char lbuff[50], rbuff[50];
> + char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>
> if (v == &rxnet->conn_proc_list) {
> seq_puts(seq,
> @@ -161,8 +165,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
> goto print;
> }
>
> - sprintf(lbuff, "%pISpc", &conn->local->srx.transport);
> - sprintf(rbuff, "%pISpc", &conn->peer->srx.transport);
> + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &conn->local->srx.transport);
> + scnprintf(rbuff, sizeof(rbuff), "%pISpc", &conn->peer->srx.transport);
> print:
> state = rxrpc_is_conn_aborted(conn) ?
> rxrpc_call_completions[conn->completion] :
> @@ -228,7 +232,7 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v)
> {
> struct rxrpc_bundle *bundle;
> struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
> - char lbuff[50], rbuff[50];
> + char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>
> if (v == &rxnet->bundle_proc_list) {
> seq_puts(seq,
> @@ -242,8 +246,8 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v)
>
> bundle = list_entry(v, struct rxrpc_bundle, proc_link);
>
> - sprintf(lbuff, "%pISpc", &bundle->local->srx.transport);
> - sprintf(rbuff, "%pISpc", &bundle->peer->srx.transport);
> + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &bundle->local->srx.transport);
> + scnprintf(rbuff, sizeof(rbuff), "%pISpc", &bundle->peer->srx.transport);
> seq_printf(seq,
> "UDP %-47.47s %-47.47s %4x %3u %3d"
> " %c%c%c %08x | %08x %08x %08x %08x %08x\n",
> @@ -279,7 +283,7 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v)
> {
> struct rxrpc_peer *peer;
> time64_t now;
> - char lbuff[50], rbuff[50];
> + char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>
> if (v == SEQ_START_TOKEN) {
> seq_puts(seq,
> @@ -290,9 +294,9 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v)
>
> peer = list_entry(v, struct rxrpc_peer, hash_link);
>
> - sprintf(lbuff, "%pISpc", &peer->local->srx.transport);
> + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &peer->local->srx.transport);
>
> - sprintf(rbuff, "%pISpc", &peer->srx.transport);
> + scnprintf(rbuff, sizeof(rbuff), "%pISpc", &peer->srx.transport);
>
> now = ktime_get_seconds();
> seq_printf(seq,
> @@ -401,7 +405,7 @@ const struct seq_operations rxrpc_peer_seq_ops = {
> static int rxrpc_local_seq_show(struct seq_file *seq, void *v)
> {
> struct rxrpc_local *local;
> - char lbuff[50];
> + char lbuff[RXRPC_PROC_ADDRBUF_SIZE];
>
> if (v == SEQ_START_TOKEN) {
> seq_puts(seq,
> @@ -412,7 +416,7 @@ static int rxrpc_local_seq_show(struct seq_file *seq, void *v)
>
> local = hlist_entry(v, struct rxrpc_local, link);
>
> - sprintf(lbuff, "%pISpc", &local->srx.transport);
> + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport);
>
> seq_printf(seq,
> "UDP %-47.47s %3u %3u %3u\n",
Do you have any evidence to confirm this issue? While the code could be
improved, I don't see how that specific error would occur. Based on a
quick experiment, the resulting string is at most 47 or 48 bytes (e.g.,
|[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]:65535|).
next prev parent reply other threads:[~2026-04-05 17:40 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-04 9:32 [PATCH] rxrpc/proc: size address buffers for %pISpc output Pengpeng Hou
2026-04-05 17:40 ` Anderson Nascimento [this message]
2026-04-06 6:10 ` Pengpeng Hou
2026-04-06 4:12 ` Anderson Nascimento
2026-04-06 8:40 ` [PATCH v2] " Pengpeng Hou
2026-04-08 8:08 ` David Howells
2026-04-08 8:21 ` Pengpeng Hou
2026-04-08 11:40 ` David Howells
2026-04-06 9:00 ` [PATCH] " Pengpeng Hou
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=16f1456c-e540-4eca-a1c7-9d43a4b18539@allelesecurity.com \
--to=anderson@allelesecurity.com \
--cc=dhowells@redhat.com \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-afs@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marc.dionne@auristor.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pengpeng@iscas.ac.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox