rxrpc: proc: size address buffers for %pISpc output

The AF_RXRPC procfs helpers format local and remote socket addresses into
fixed 50-byte stack buffers with "%pISpc".

That is too small for the longest current-tree IPv6-with-port form the
formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a
dotted-quad tail not only for v4mapped addresses, but also for ISATAP
addresses via ipv6_addr_is_isatap().

As a result, a case such as

  [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535

is possible with the current formatter. That is 50 visible characters, so
51 bytes including the trailing NUL, which does not fit in the existing
char[50] buffers used by net/rxrpc/proc.c.

Size the buffers from the formatter's maximum textual form and switch the
call sites to scnprintf().

Changes since v1:
- correct the changelog to cite the actual maximum current-tree case
  explicitly
- frame the proof around the ISATAP formatting path instead of the earlier
  mapped-v4 example

Fixes: 75b54cb57ca3 ("rxrpc: Add IPv6 support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Anderson Nascimento <anderson@allelesecurity.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260408121252.2249051-22-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/rxrpc/proc.c b/net/rxrpc/proc.c
index 7755fca5beb86adb848fbc3b7855d17d24651a83..e9a27fa7b25d8b3027e6dbb68a003b127e18c2b4 100644 (file)
--- a/net/rxrpc/proc.c
+++ b/net/rxrpc/proc.c
@@ -10,6 +10,10 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
+#define RXRPC_PROC_ADDRBUF_SIZE \
+       (sizeof("[xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255]") + \
+        sizeof(":12345"))
+
 static const char *const rxrpc_conn_states[RXRPC_CONN__NR_STATES] = {
        [RXRPC_CONN_UNUSED]                     = "Unused  ",
        [RXRPC_CONN_CLIENT_UNSECURED]           = "ClUnsec ",
@@ -53,7 +57,7 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
        struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
        enum rxrpc_call_state state;
        rxrpc_seq_t tx_bottom;
-       char lbuff[50], rbuff[50];
+       char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
        long timeout = 0;
 
        if (v == &rxnet->calls) {
@@ -69,11 +73,11 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
 
        local = call->local;
        if (local)
-               sprintf(lbuff, "%pISpc", &local->srx.transport);
+               scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport);
        else
                strcpy(lbuff, "no_local");
 
-       sprintf(rbuff, "%pISpc", &call->dest_srx.transport);
+       scnprintf(rbuff, sizeof(rbuff), "%pISpc", &call->dest_srx.transport);
 
        state = rxrpc_call_state(call);
        if (state != RXRPC_CALL_SERVER_PREALLOC)
@@ -142,7 +146,7 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
        struct rxrpc_connection *conn;
        struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
        const char *state;
-       char lbuff[50], rbuff[50];
+       char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
 
        if (v == &rxnet->conn_proc_list) {
                seq_puts(seq,
@@ -161,8 +165,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
                goto print;
        }
 
-       sprintf(lbuff, "%pISpc", &conn->local->srx.transport);
-       sprintf(rbuff, "%pISpc", &conn->peer->srx.transport);
+       scnprintf(lbuff, sizeof(lbuff), "%pISpc", &conn->local->srx.transport);
+       scnprintf(rbuff, sizeof(rbuff), "%pISpc", &conn->peer->srx.transport);
 print:
        state = rxrpc_is_conn_aborted(conn) ?
                rxrpc_call_completions[conn->completion] :
@@ -228,7 +232,7 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v)
 {
        struct rxrpc_bundle *bundle;
        struct rxrpc_net *rxnet = rxrpc_net(seq_file_net(seq));
-       char lbuff[50], rbuff[50];
+       char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
 
        if (v == &rxnet->bundle_proc_list) {
                seq_puts(seq,
@@ -242,8 +246,8 @@ static int rxrpc_bundle_seq_show(struct seq_file *seq, void *v)
 
        bundle = list_entry(v, struct rxrpc_bundle, proc_link);
 
-       sprintf(lbuff, "%pISpc", &bundle->local->srx.transport);
-       sprintf(rbuff, "%pISpc", &bundle->peer->srx.transport);
+       scnprintf(lbuff, sizeof(lbuff), "%pISpc", &bundle->local->srx.transport);
+       scnprintf(rbuff, sizeof(rbuff), "%pISpc", &bundle->peer->srx.transport);
        seq_printf(seq,
                   "UDP   %-47.47s %-47.47s %4x %3u %3d"
                   " %c%c%c %08x | %08x %08x %08x %08x %08x\n",
@@ -279,7 +283,7 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v)
 {
        struct rxrpc_peer *peer;
        time64_t now;
-       char lbuff[50], rbuff[50];
+       char lbuff[RXRPC_PROC_ADDRBUF_SIZE], rbuff[RXRPC_PROC_ADDRBUF_SIZE];
 
        if (v == SEQ_START_TOKEN) {
                seq_puts(seq,
@@ -290,9 +294,9 @@ static int rxrpc_peer_seq_show(struct seq_file *seq, void *v)
 
        peer = list_entry(v, struct rxrpc_peer, hash_link);
 
-       sprintf(lbuff, "%pISpc", &peer->local->srx.transport);
+       scnprintf(lbuff, sizeof(lbuff), "%pISpc", &peer->local->srx.transport);
 
-       sprintf(rbuff, "%pISpc", &peer->srx.transport);
+       scnprintf(rbuff, sizeof(rbuff), "%pISpc", &peer->srx.transport);
 
        now = ktime_get_seconds();
        seq_printf(seq,
@@ -401,7 +405,7 @@ const struct seq_operations rxrpc_peer_seq_ops = {
 static int rxrpc_local_seq_show(struct seq_file *seq, void *v)
 {
        struct rxrpc_local *local;
-       char lbuff[50];
+       char lbuff[RXRPC_PROC_ADDRBUF_SIZE];
 
        if (v == SEQ_START_TOKEN) {
                seq_puts(seq,
@@ -412,7 +416,7 @@ static int rxrpc_local_seq_show(struct seq_file *seq, void *v)
 
        local = hlist_entry(v, struct rxrpc_local, link);
 
-       sprintf(lbuff, "%pISpc", &local->srx.transport);
+       scnprintf(lbuff, sizeof(lbuff), "%pISpc", &local->srx.transport);
 
        seq_printf(seq,
                   "UDP   %-47.47s %3u %3u %3u\n",