From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtpbgeu1.qq.com (smtpbgeu1.qq.com [52.59.177.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E980F378D87 for ; Mon, 29 Jun 2026 01:44:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=52.59.177.22 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782697458; cv=none; b=Dt0Kk+d05QmflE0TJcPmUpuOwssrpVCryGuyxSsXf2nPj7aUSa6660AQCe6xJ3AMOJ0npATAWUGbhuhOO7sCqt6wFD8IiE/q/HTTqYI7NbFWz198ADmZ9HoAhepHWwOzuBhdJrFTeZqoB6FhD86pQOQfviWhGvOCC3UyooVeZr4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782697458; c=relaxed/simple; bh=lfLFRI6YnnXGpiD/ay8lP7CHWKCeBcVPEC5dz3tXUYk=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=UnudRS8HnjarlBWJSe8Pp2Rujp/kslQfEhJmWc5/fuV0KJZQkdcOJx3NLGYWOEOlqzlLE3ioh6kuadhZtZnxWXbQxo0ZX9GjPR/MrVzwUBfkipbGL88gSB+n35x5kvOp2WpHeW3JRXtnuaoRvr3qiRwZIsi4QVBQRDCah2WTF18= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=ny+ZY+iB; arc=none smtp.client-ip=52.59.177.22 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="ny+ZY+iB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1782697422; bh=d/eHSUknk0sCy7CxDqOch56J+Ya+GbJ/5sqC4UKx71s=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=ny+ZY+iBvuvOxbbG6Qr5fLuPLzooR7yZIhThEGYZqBoSCp7BGXCCA8z+u5rXxLRlK ol2bwUcxJVDByJSPGcYx6mxJx1GEWuWXQYV/ZisuPXbpY07/wGAdT4/Ru94N1bSGMZ mFNbqd18eA+qdg0+lCzov4zlLK3hbzoKLxd8MeA8= X-QQ-mid: zesmtpsz7t1782697417t1fff5ac5 X-QQ-Originating-IP: NOE+I24n44xPEKmRpXWUns3nbx+KmIpjpirkQUuN0bk= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Mon, 29 Jun 2026 09:43:34 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 10259888320296844636 EX-QQ-RecipientCnt: 7 From: Yichong Chen To: akpm@linux-foundation.org Cc: vishal.moola@gmail.com, ye.liu@linux.dev, zhen.ni@easystack.cn, chenyichong@uniontech.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v5 3/3] tools/mm/page_owner_sort: bound pattern output copies Date: Mon, 29 Jun 2026 09:43:16 +0800 Message-Id: <20260629014316.130307-4-chenyichong@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260629014316.130307-1-chenyichong@uniontech.com> References: <20260629014316.130307-1-chenyichong@uniontech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-QQ-SENDSIZE: 520 Feedback-ID: zesmtpsz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: OEU2aer3F3z2nGr2BYCcmQRyE5JBGAP3Or6xYA388ComUgHcBtS5UybC cEFcXi0xEZXTUtdycd8kXEcX9CbrvOhsv8omTO7EDU1Y0IY7nepzWOJNaO0bQ7CywJv3373 zOYd3o7SEFCUrn2EzkUTTXmESD/OMWgQ0JmyfoVApy2oLxlaQse6uFWDxiKRvO5NeVeys/F RZSl22J8rop9CNG+Mlgr2OR/RSidSGBP3jTpYACxsMDSEyh67KuJ4Lcb06e0Y3CEr25R3ZG V7i0vrQ38I0dXxxwl4f5qRJqqnDRo//0FAZus6HS6v9P+07T0z3iyGhGHKSpI/ZFVO4bh8a 5un7c63J81RK9unsQqVZymOOz2+rSbXclL19Hqv8SSJC/oZoSBeZEgEfY9k+ycwpodIFBz3 jnE1ozVEl6ICZhqwX0hkQjcOZ/CIxHwHjMbhuf//7QUaYLaVujfuSEk2vldpdMm6oTqjcmW t2HkTimjSOmyhgXu+LsddaLejuddwHzrZe4FvyelL08vPxMpwJ7tLkw0hy1zqEjOHqUXwtl pEH2HMlHUV6yTranwodsKlz/5QX/WtxBSNKM8xZPQ9308ruFDBlvN91dEhwVj9ikJGdQT1b XOwIO93r5lgvOdrBiCD0EcQtw0n3OsdT4fwDQoqzbUlhiNlG5mGctG3YX374OpawFOYD79b GqctzYqXC4nrvBUr3ZHfk5Ffn6cg1qZwClr/fVZYKhlvl7r4SajlXIL1Wa2W9HnHdWCgbb2 zMUW1JGiNk6C+aeZKtlGRApIchClgOqpsp8+njxTRtkaWuUp3AvMz8V3U6mne5Z8Q4Qdswh HARS16pDuFtt1SESkIvClcy6Ykm3bpyXboiQ/lw9QOsRGQs3RjjmiSUyHPOG8hzCitsPvmo j41R/T772iw7rIeWANBjgaFbd0DKMPkUbJoCX2qqBhPBi78fZyNdLJ3EoC975cgbl8uYbnz Myt0kkLEXSrI5SO17O0uBah3e09mhE5AD79prCT8bzphwHX51CiY6ydulkAr1eWSy9DOcZ3 JS9Qwziof3yzgQwGPX+4QbJN/RAuxByeRCVMPtfnLO0kOdFxNxOV3k2K8LMJHJx5I/vxprX +G43AzDUJOj X-QQ-XMRINFO: NI4Ajvh11aEjEMj13RCX7UuhPEoou2bs1g== X-QQ-RECHKSPAM: 0 search_pattern() copies a regex capture into caller-provided buffers without knowing their sizes. Several callers pass fixed-size buffers, including FIELD_BUFF and TASK_COMM_LEN. Pass the destination size to search_pattern(), reject captures that do not fit before copying them, and terminate the output string inside search_pattern(). Signed-off-by: Yichong Chen --- tools/mm/page_owner_sort.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/tools/mm/page_owner_sort.c b/tools/mm/page_owner_sort.c index 4c9be28abe3b..35d3d254941c 100644 --- a/tools/mm/page_owner_sort.c +++ b/tools/mm/page_owner_sort.c @@ -237,7 +237,8 @@ static int remove_pattern(regex_t *pattern, char *buf, int len) return len - (pmatch[1].rm_eo - pmatch[1].rm_so); } -static int search_pattern(regex_t *pattern, char *pattern_str, char *buf) +static int search_pattern(regex_t *pattern, char *pattern_str, + size_t pattern_str_size, char *buf) { int err, val_len; regmatch_t pmatch[2]; @@ -249,6 +250,12 @@ static int search_pattern(regex_t *pattern, char *pattern_str, char *buf) return -1; } val_len = pmatch[1].rm_eo - pmatch[1].rm_so; + if ((size_t)val_len >= pattern_str_size) { + if (debug_on) + fprintf(stderr, "pattern too long in %s\n", buf); + return -1; + } memcpy(pattern_str, buf + pmatch[1].rm_so, val_len); + pattern_str[val_len] = '\0'; @@ -307,7 +314,8 @@ static int get_page_num(char *buf) char order_str[FIELD_BUFF] = {0}; char *endptr; - search_pattern(&order_pattern, order_str, buf); + if (search_pattern(&order_pattern, order_str, sizeof(order_str), buf) < 0) + return 0; errno = 0; order_val = strtol(order_str, &endptr, 10); if (order_val > 64 || errno != 0 || endptr == order_str || *endptr != '\0') { @@ -325,7 +333,8 @@ static pid_t get_pid(char *buf) char pid_str[FIELD_BUFF] = {0}; char *endptr; - search_pattern(&pid_pattern, pid_str, buf); + if (search_pattern(&pid_pattern, pid_str, sizeof(pid_str), buf) < 0) + return -1; errno = 0; pid = strtol(pid_str, &endptr, 10); if (errno != 0 || endptr == pid_str || *endptr != '\0') { @@ -344,7 +353,8 @@ static pid_t get_tgid(char *buf) char tgid_str[FIELD_BUFF] = {0}; char *endptr; - search_pattern(&tgid_pattern, tgid_str, buf); + if (search_pattern(&tgid_pattern, tgid_str, sizeof(tgid_str), buf) < 0) + return -1; errno = 0; tgid = strtol(tgid_str, &endptr, 10); if (errno != 0 || endptr == tgid_str || *endptr != '\0') { @@ -363,7 +373,9 @@ static __u64 get_ts_nsec(char *buf) char ts_nsec_str[FIELD_BUFF] = {0}; char *endptr; - search_pattern(&ts_nsec_pattern, ts_nsec_str, buf); + if (search_pattern(&ts_nsec_pattern, ts_nsec_str, + sizeof(ts_nsec_str), buf) < 0) + return -1; errno = 0; ts_nsec = strtoull(ts_nsec_str, &endptr, 10); if (errno != 0 || endptr == ts_nsec_str || *endptr != '\0') { @@ -384,7 +396,10 @@ static char *get_comm(char *buf) memset(comm_str, 0, TASK_COMM_LEN); - search_pattern(&comm_pattern, comm_str, buf); + if (search_pattern(&comm_pattern, comm_str, TASK_COMM_LEN, buf) < 0) { + free(comm_str); + return NULL; + } errno = 0; if (errno != 0) { if (debug_on) -- 2.51.0