[PATCH] rxrpc/proc: size address buffers for %pISpc output

[Anderson Nascimento]

On 4/4/26 6:32 AM, Pengpeng Hou wrote:
> The AF_RXRPC procfs helpers format local and remote socket addresses into
> fixed 50-byte stack buffers with "%pISpc".
>
> That is too small for the longest IPv6-with-port form the formatter can
> produce: a compressed IPv6 address still permits a bracketed mapped-IPv4
> spelling plus the trailing port, which exceeds 50 bytes including the final
> NUL.
>
> Size the buffers from the formatters maximum textual form and switch the
> call sites to scnprintf().
>
> Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>
> ---
>   net/rxrpc/proc.c | 32 ++++++++++++++++++--------------
>   1 file changed, 18 insertions(+), 14 deletions(-)
>
> diff --git a/net/rxrpc/proc.c b/net/rxrpc/proc.c
> index 59292f7f9205..7925d4569776 100644
> --- a/net/rxrpc/proc.c
> +++ b/net/rxrpc/proc.c
> @@ -10,6 +10,10 @@
>   #include <net/af_rxrpc.h>
>   #include "ar-internal.h"
>   
> +#define RXRPC_PROC_ADDRBUF_SIZE \
> +	(sizeof("[xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255]") + \
> +	 sizeof(":12345"))
> +
>   static const char *const rxrpc_conn_states[RXRPC_CONN__NR_STATES] = {
>   	[RXRPC_CONN_UNUSED]			= "Unused  ",
>   	[RXRPC_CONN_CLIENT_UNSECURED]		= "ClUnsec ",
> @@ -53,7 +57,7 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
>   	struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
>   	enum rxrpc_call_state state;
>   	rxrpc_seq_t tx_bottom;
> -	char lbuff[50], rbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   	long timeout = 0;
>   
>   	if (v == &rxnet->calls) {
> @@ -69,11 +73,11 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
>   
>   	local = call->local;
>   	if (local)
> -		sprintf(lbuff, "%pISpc", &local->srx.transport);
> +		scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport);
>   	else
>   		strcpy(lbuff, "no_local");
>   
> -	sprintf(rbuff, "%pISpc", &call->dest_srx.transport);
> +	scnprintf(rbuff, sizeof(rbuff), "%pISpc", &call->dest_srx.transport);
>   
>   	state = rxrpc_call_state(call);
>   	if (state != RXRPC_CALL_SERVER_PREALLOC)
> @@ -142,7 +146,7 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
>   	struct rxrpc_connection *conn;
>   	struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
>   	const char *state;
> -	char lbuff[50], rbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   
>   	if (v == &rxnet->conn_proc_list) {
>   		seq_puts(seq,
> @@ -161,8 +165,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
>   		goto print;
>   	}
>   
> -	sprintf(lbuff, "%pISpc", &conn->local->srx.transport);
> -	sprintf(rbuff, "%pISpc", &conn->peer->srx.transport);
> +	scnprintf(lbuff, sizeof(lbuff), "%pISpc", &conn->local->srx.transport);
> +	scnprintf(rbuff, sizeof(rbuff), "%pISpc", &conn->peer->srx.transport);
>   print:
>   	state = rxrpc_is_conn_aborted(conn) ?
>   		rxrpc_call_completions[conn->completion] :
> @@ -228,7 +232,7 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v)
>   {
>   	struct rxrpc_bundle *bundle;
>   	struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
> -	char lbuff[50], rbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   
>   	if (v == &rxnet->bundle_proc_list) {
>   		seq_puts(seq,
> @@ -242,8 +246,8 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v)
>   
>   	bundle = list_entry(v, struct rxrpc_bundle, proc_link);
>   
> -	sprintf(lbuff, "%pISpc", &bundle->local->srx.transport);
> -	sprintf(rbuff, "%pISpc", &bundle->peer->srx.transport);
> +	scnprintf(lbuff, sizeof(lbuff), "%pISpc", &bundle->local->srx.transport);
> +	scnprintf(rbuff, sizeof(rbuff), "%pISpc", &bundle->peer->srx.transport);
>   	seq_printf(seq,
>   		   "UDP   %-47.47s %-47.47s %4x %3u %3d"
>   		   " %c%c%c %08x | %08x %08x %08x %08x %08x\n",
> @@ -279,7 +283,7 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v)
>   {
>   	struct rxrpc_peer *peer;
>   	time64_t now;
> -	char lbuff[50], rbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   
>   	if (v == SEQ_START_TOKEN) {
>   		seq_puts(seq,
> @@ -290,9 +294,9 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v)
>   
>   	peer = list_entry(v, struct rxrpc_peer, hash_link);
>   
> -	sprintf(lbuff, "%pISpc", &peer->local->srx.transport);
> +	scnprintf(lbuff, sizeof(lbuff), "%pISpc", &peer->local->srx.transport);
>   
> -	sprintf(rbuff, "%pISpc", &peer->srx.transport);
> +	scnprintf(rbuff, sizeof(rbuff), "%pISpc", &peer->srx.transport);
>   
>   	now = ktime_get_seconds();
>   	seq_printf(seq,
> @@ -401,7 +405,7 @@ const struct seq_operations rxrpc_peer_seq_ops = {
>   static int rxrpc_local_seq_show(struct seq_file *seq, void *v)
>   {
>   	struct rxrpc_local *local;
> -	char lbuff[50];
> +	char lbuff[RXRPC_PROC_ADDRBUF_SIZE];
>   
>   	if (v == SEQ_START_TOKEN) {
>   		seq_puts(seq,
> @@ -412,7 +416,7 @@ static int rxrpc_local_seq_show(struct seq_file *seq, void *v)
>   
>   	local = hlist_entry(v, struct rxrpc_local, link);
>   
> -	sprintf(lbuff, "%pISpc", &local->srx.transport);
> +	scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport);
>   
>   	seq_printf(seq,
>   		   "UDP   %-47.47s %3u %3u %3u\n",

Do you have any evidence to confirm this issue? While the code could be 
improved, I don't see how that specific error would occur. Based on a 
quick experiment, the resulting string is at most 47 or 48 bytes (e.g., 
|[ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]:65535|).