From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08B8042E013; Tue, 21 Jul 2026 19:01:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784660501; cv=none; b=bW+3v41QvHON5/rNR3imuqXtnzfrazwAkcTDZ1KUYXzGmY+nnfzEAf5Jsl6SkWiDtrZsxzrId8MQjpggq+wD1FM7ocFgxwsZGSAEaVku5W54xfYIbsBiG3ZOWItSTX/gqMh9PAGkMZAsGvU12o/x9Ks5YOOExDbqdpT2T3m0xEQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784660501; c=relaxed/simple; bh=H78CJxWd/M0Vw0PExeeT0Sw4yq6wV6WxxJM8qhFALfo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PGaw1xbE10w4tYWxBKiM6h7vaZVOJ16TZITIrVonG+QU9OxkTfbXcWRNJcjZcVXSQ6dNa6SfPcQTB+YJ3N/hOoXpFMKqEbnGC/r1Wp0GJIcyQH8/r+yhmyVVSABl83aDNkQBm+uMpMa6xZ6jicuISNkNCvgA0btW2RbxEb3LgkE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=RapswtP0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="RapswtP0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90C1C1F0155F; Tue, 21 Jul 2026 19:01:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784660465; bh=rmOitev0gL7wL6kOoAmYXZ6HtfK6U/xi5ygTbzzUKwQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RapswtP0PNSvmnbz3vR6JvvmCZl0ruTH0r4GqEkeApSKfM4Z6MgPQOMjz+6JWrz3U EMbkeI59djh7xLKXGcShOGg+sJ4UK/bFk868M9ITyCbU/orj4meM3m+ZpKwyemixsT xgvkCFPpgFD4PYgG4TGMTfx5BkxTpUrMKcK6MHo0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, sashiko-bot , Ian Rogers , Arnaldo Carvalho de Melo , Sasha Levin Subject: [PATCH 7.1 0990/2077] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path Date: Tue, 21 Jul 2026 17:11:03 +0200 Message-ID: <20260721152616.169037422@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152552.646164743@linuxfoundation.org> References: <20260721152552.646164743@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arnaldo Carvalho de Melo [ Upstream commit 227a8748742f0263f1fe3131449b44563b77a209 ] hists__scnprintf_title() accumulates formatted output into a buffer using scnprintf() for all filter clauses except the UID filter, which uses snprintf(). If the buffer fills up and snprintf() returns more than the remaining space, printed exceeds size and the next 'size - printed' underflows, causing later scnprintf() calls to write past the buffer. Switch the UID filter clause to scnprintf() to match the rest of the function. Fixes: 25c312dbf88ca402 ("perf hists: Move hists__scnprintf_title() away from the TUI code") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Arnaldo Carvalho de Melo Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin --- tools/perf/util/hist.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c index 747fdc455c80ec..2038c1d20acffa 100644 --- a/tools/perf/util/hist.c +++ b/tools/perf/util/hist.c @@ -2963,9 +2963,10 @@ int __hists__scnprintf_title(struct hists *hists, char *bf, size_t size, bool sh ev_name, sample_freq_str, enable_ref ? ref : " ", nr_events); - if (hists->uid_filter_str) - printed += snprintf(bf + printed, size - printed, - ", UID: %s", hists->uid_filter_str); + if (hists->uid_filter_str) { + printed += scnprintf(bf + printed, size - printed, + ", UID: %s", hists->uid_filter_str); + } if (thread) { if (hists__has(hists, thread)) { printed += scnprintf(bf + printed, size - printed, -- 2.53.0