Re: [PATCH mptcp-next v3] selftests: mptcp: diag: fix stack buffer overflow in get_subflow_info()

Hi Jiangshan, Geliang,

On 03/07/2026 03:09, Geliang Tang wrote:
> Hi Jiangshan,
> 
> On Thu, 2026-07-02 at 14:29 +0800, Jiangshan Yi wrote:
>> get_subflow_info() parses the subflow address string with:
>>
>> 	char saddr[64], daddr[64];
>>
>> 	ret = sscanf(subflow_addrs, "%[^:]:%d %[^:]:%d",
>> 		     saddr, &sport, daddr, &dport);
>>
>> The subflow_addrs buffer holds up to 1024 bytes and is taken directly
>> from the command line ("-c" argument). The "%[^:]" conversions have
>> no
>> maximum field width, so if the address substring before the ':'
>> exceeds
>> 63 bytes, sscanf() writes past the end of the 64-byte saddr/daddr
>> stack
>> buffers. This overflows the stack, corrupting adjacent stack data
>> such
>> as the saved return address, and can crash the tool or lead to
>> out-of-bounds writes controlled by user-supplied input.
>>
>> Bound both string conversions to the destination buffer size by
>> adding
>> an explicit maximum field width of 63 (leaving room for the
>> terminating
>> NUL), so at most 63 bytes are written into each 64-byte buffer:
>>
>> 	ret = sscanf(subflow_addrs, "%63[^:]:%d %63[^:]:%d",
>> 		     saddr, &sport, daddr, &dport);
>>
>> Reviewed-by: Geliang Tang <[email protected]>
>> Signed-off-by: Jiangshan Yi <[email protected]>
>> ---
>> v3:
>>  - drop the Fixes tag: this is a cleanup/hardening, not a fix
>> (Geliang)
>>  - drop the Suggested-by tag, keep Geliang's Reviewed-by (Geliang)
> 
> Actually, there's no need to send this v3, since it doesn't introduce
> any code changes compared to v2; we could simply reply and continue the
> discussion on the v2 thread.
Thank you for the patch and the review!

When sending a new version, please start a new thread, do not reply to
an existing one:

 https://docs.kernel.org/process/maintainer-netdev.html#resending-after-review

New patches for t/upstream:
- 46e0ae412a9c: selftests: mptcp: diag: fix stack buffer overflow in
get_subflow_info()
- Results: e486d89a0699..588708fb07a7 (export)

Tests are now in progress:

- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/59dd662fd0777835b9f742de6298ba0953675008/checks

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.