From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f41.google.com (mail-dl1-f41.google.com [74.125.82.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 106FB2D5C91 for ; Sun, 5 Apr 2026 17:40:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775410828; cv=none; b=dpyPUjlDe/CKeF9gY77vWEeT3ebfKm8oeQz2ksBIh4nCDVUU88+DajCG+xVFRC2QkS/E2TRWj4Ph0OI4blu2t1PtwP6tB4dJigIJ0tbLouOSyY74jZLp1fZJvwatMpkVTd5nkUDH/kvg1z9mmcRV8i5L3sBQV9ZFDxRf+vqOGFA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775410828; c=relaxed/simple; bh=Od8QmirE7EkLSxDA4qy4aAGMsJB+SnUA05UuMXwcpHs=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Ot1BGsXRkKmAJC5YLSpDSDTOddY6Ap/8HqQzGSc8dWl/n0kczaGCn1qmGuDBaDOkZ1YmU+9m/71Nk3lb9ZtwB5L+xvyw3pOMg96huFnKblI6AnzltxV8trmCTWpHsFoJQZBIa/ZCiPpD3QRnhpvf4pnzj7cRQwwIma2Q5TTrU9g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=allelesecurity.com; spf=pass smtp.mailfrom=allelesecurity.com; dkim=pass (1024-bit key) header.d=allelesecurity.com header.i=@allelesecurity.com header.b=nfpBeRk/; arc=none smtp.client-ip=74.125.82.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=allelesecurity.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=allelesecurity.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=allelesecurity.com header.i=@allelesecurity.com header.b="nfpBeRk/" Received: by mail-dl1-f41.google.com with SMTP id a92af1059eb24-1273349c56bso3981045c88.0 for ; Sun, 05 Apr 2026 10:40:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=allelesecurity.com; s=google; t=1775410825; x=1776015625; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=zADj+v7r/QefwidmH66YAGAAPletG8mlfRYXnGJaQv0=; b=nfpBeRk/Ycifpdv+mshin5R8oZnmpb1S6CMCWq1XHSGkDlq+Zxv1koCb0fMUr2CL/B 1M9AtmGNBUPFrlvEp21xlJvLel6DjPxOPzf4RtjHp8gPcOIUq9gY00gmMBrJHBcigik5 i5mx1pbwlg7JpNJWYs2U12xWbMavWOaZaOpwQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775410825; x=1776015625; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=zADj+v7r/QefwidmH66YAGAAPletG8mlfRYXnGJaQv0=; b=HdV0l8GIymHlHmte+q7W8djd+kpGd93yiHucbygeffQgxYpgXKqJqv+/4Lj0WOoNUh r4qsxFHRQXPTi2PoOJL4zy1WZ/dYdjqAa8/z6JNI5NncNyimpsHtCmp0W15djXN8f925 jUB4rzxvzB8T3cyS32K7X6pcKWrsDCSdIMDpLwsfbKqhhpGTHCLIjiPBoNeSoBXDFw+C o+RlU22d+5JmO9GhQBnlAMy0h9O7Tc0yay24A2eynVElAFD84Ectm45o8QZi5I4dH22Q h5zWw4d3IC/OEyAzB9fq8r/l+sKHjEU8LRFehFxBabL96tBMhPfBDVa97PkLnbjanuZn oYaQ== X-Forwarded-Encrypted: i=1; AJvYcCWPVuJJENyKvUT3i2AMgyCkgGbzIjU0Spw+cXsh7ZNojWLRs+YuSewOSHZ3f5/7p0UH8kGIlJuwXmCN5y8=@vger.kernel.org X-Gm-Message-State: AOJu0Yx8K2pM/pG78sxYkQEA4HaD9Vcqq/RRSpwAe/2fvVZXsQ6MiOI+ AH9Yxws/Nnc9um3TNpEJ6wSJLKaFHR/loskhNpExU1clz/K9v/9kBUdpQWxNkax3FdE= X-Gm-Gg: AeBDiev8GbEl4JamCZedbc/Ibe6c26rdwB27gg7OoKtFCGw9Hy3L97UTEtZQZtstTlz 3FPnC7CVqDTs8Y/pxP6QuzyBoEFj3QRlLdR98XhhwgXoFydwCOseZte8HUVST9mKhx0YOdZ2rXf hO2FoEtFRZmIXQiU8OMMAUhLQfCt/tjLEErwR8aTbIal1GZ7N1ndnEmK7U1x/gTZ1epWPtU2u6I 2hVdbRJwNJRinLKJ6gT2/HVnFTBpqwOAvQInvU4zfljA5uLc9bzkHzPwkLo4cquMUAjT1quGKrb zypS3udb3DvjqBqDEsU5CAZwQmd7UaCCYgQ1H2r9o648ZkVKDfI2t/WA1gA5IsSxcsuIVPvdu/+ 5U6lQbzGrPGoWLXc+Rzp4MmTOYDA8AHM8kDPCE8aRRlP8Nmyyp65FQ1DRrEdp7fm+5S30ODxNZB jaG/ReSmP4Vf5PYu2PcUtEYo0oRHpZ8T5JsjHr X-Received: by 2002:a05:7022:61f:b0:12a:6fb7:8801 with SMTP id a92af1059eb24-12bfb7074cfmr4464778c88.14.1775410824999; Sun, 05 Apr 2026 10:40:24 -0700 (PDT) Received: from [192.168.1.2] ([179.105.152.82]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-12c05b7ffd4sm3990119c88.13.2026.04.05.10.40.21 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 05 Apr 2026 10:40:24 -0700 (PDT) Message-ID: <16f1456c-e540-4eca-a1c7-9d43a4b18539@allelesecurity.com> Date: Sun, 5 Apr 2026 14:40:20 -0300 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] rxrpc/proc: size address buffers for %pISpc output To: Pengpeng Hou , David Howells , Marc Dionne Cc: Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260404190004.4-rxrpc-proc-pengpeng@iscas.ac.cn> Content-Language: en-US From: Anderson Nascimento In-Reply-To: <20260404190004.4-rxrpc-proc-pengpeng@iscas.ac.cn> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 4/4/26 6:32 AM, Pengpeng Hou wrote: > The AF_RXRPC procfs helpers format local and remote socket addresses into > fixed 50-byte stack buffers with "%pISpc". > > That is too small for the longest IPv6-with-port form the formatter can > produce: a compressed IPv6 address still permits a bracketed mapped-IPv4 > spelling plus the trailing port, which exceeds 50 bytes including the final > NUL. > > Size the buffers from the formatters maximum textual form and switch the > call sites to scnprintf(). > > Signed-off-by: Pengpeng Hou > --- > net/rxrpc/proc.c | 32 ++++++++++++++++++-------------- > 1 file changed, 18 insertions(+), 14 deletions(-) > > diff --git a/net/rxrpc/proc.c b/net/rxrpc/proc.c > index 59292f7f9205..7925d4569776 100644 > --- a/net/rxrpc/proc.c > +++ b/net/rxrpc/proc.c > @@ -10,6 +10,10 @@ > #include > #include "ar-internal.h" > > +#define RXRPC_PROC_ADDRBUF_SIZE \ > + (sizeof("[xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255]") + \ > + sizeof(":12345")) > + > static const char *const rxrpc_conn_states[RXRPC_CONN__NR_STATES] = { > [RXRPC_CONN_UNUSED] = "Unused ", > [RXRPC_CONN_CLIENT_UNSECURED] = "ClUnsec ", > @@ -53,7 +57,7 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v) > struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq)); > enum rxrpc_call_state state; > rxrpc_seq_t tx_bottom; > - char lbuff[50], rbuff[50]; > + char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE]; > long timeout = 0; > > if (v == &rxnet->calls) { > @@ -69,11 +73,11 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v) > > local = call->local; > if (local) > - sprintf(lbuff, "%pISpc", &local->srx.transport); > + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport); > else > strcpy(lbuff, "no_local"); > > - sprintf(rbuff, "%pISpc", &call->dest_srx.transport); > + scnprintf(rbuff, sizeof(rbuff), "%pISpc", &call->dest_srx.transport); > > state = rxrpc_call_state(call); > if (state != RXRPC_CALL_SERVER_PREALLOC) > @@ -142,7 +146,7 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v) > struct rxrpc_connection *conn; > struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq)); > const char *state; > - char lbuff[50], rbuff[50]; > + char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE]; > > if (v == &rxnet->conn_proc_list) { > seq_puts(seq, > @@ -161,8 +165,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v) > goto print; > } > > - sprintf(lbuff, "%pISpc", &conn->local->srx.transport); > - sprintf(rbuff, "%pISpc", &conn->peer->srx.transport); > + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &conn->local->srx.transport); > + scnprintf(rbuff, sizeof(rbuff), "%pISpc", &conn->peer->srx.transport); > print: > state = rxrpc_is_conn_aborted(conn) ? > rxrpc_call_completions[conn->completion] : > @@ -228,7 +232,7 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v) > { > struct rxrpc_bundle *bundle; > struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq)); > - char lbuff[50], rbuff[50]; > + char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE]; > > if (v == &rxnet->bundle_proc_list) { > seq_puts(seq, > @@ -242,8 +246,8 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v) > > bundle = list_entry(v, struct rxrpc_bundle, proc_link); > > - sprintf(lbuff, "%pISpc", &bundle->local->srx.transport); > - sprintf(rbuff, "%pISpc", &bundle->peer->srx.transport); > + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &bundle->local->srx.transport); > + scnprintf(rbuff, sizeof(rbuff), "%pISpc", &bundle->peer->srx.transport); > seq_printf(seq, > "UDP %-47.47s %-47.47s %4x %3u %3d" > " %c%c%c %08x | %08x %08x %08x %08x %08x\n", > @@ -279,7 +283,7 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v) > { > struct rxrpc_peer *peer; > time64_t now; > - char lbuff[50], rbuff[50]; > + char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE]; > > if (v == SEQ_START_TOKEN) { > seq_puts(seq, > @@ -290,9 +294,9 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v) > > peer = list_entry(v, struct rxrpc_peer, hash_link); > > - sprintf(lbuff, "%pISpc", &peer->local->srx.transport); > + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &peer->local->srx.transport); > > - sprintf(rbuff, "%pISpc", &peer->srx.transport); > + scnprintf(rbuff, sizeof(rbuff), "%pISpc", &peer->srx.transport); > > now = ktime_get_seconds(); > seq_printf(seq, > @@ -401,7 +405,7 @@ const struct seq_operations rxrpc_peer_seq_ops = { > static int rxrpc_local_seq_show(struct seq_file *seq, void *v) > { > struct rxrpc_local *local; > - char lbuff[50]; > + char lbuff[RXRPC_PROC_ADDRBUF_SIZE]; > > if (v == SEQ_START_TOKEN) { > seq_puts(seq, > @@ -412,7 +416,7 @@ static int rxrpc_local_seq_show(struct seq_file *seq, void *v) > > local = hlist_entry(v, struct rxrpc_local, link); > > - sprintf(lbuff, "%pISpc", &local->srx.transport); > + scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport); > > seq_printf(seq, > "UDP %-47.47s %3u %3u %3u\n", Do you have any evidence to confirm this issue? While the code could be improved, I don't see how that specific error would occur. Based on a quick experiment, the resulting string is at most 47 or 48 bytes (e.g., |[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]:65535|).