From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793831304; b=0MQZzNnJhMHWf1+dth0IaUkRBGODS/EyJOcvKyDIoilT5J2UPBLztn7ee3/pPeGMESCr Mg5W44Sn/BVMNpiZ7SU+efJHgdKki+ux29KGR/kdXfKE1q8dZuVmNxFKebMmJMfpbTwik ztQTCqGaH6fX6+YZXi+79M+yECHUnxGY2PllJjOSb6oReNtPfmV37GnwWGonuwp/2iYZ7 AFJX4Yo6NaR49JZLTLNSiapR1RZ2pccuxHyiqqMceVFc6oy5l8OeC+avtizbx2eGbro31 KRPB4CH9MlnxhMm3UU5773iTOxJz4jsYvvhmbtCnUIblaPMZdxZ3onFTcjlK/L6I4fQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793831304; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=ahsRJtaFsLtPHBaUPqEjPjQ8t2rSujJN7LMITHy06ps=; b=ZN0vu2+YJ4cUjyF4Ktm6iMtBWpEpuhlxXeCfjnTBAEZM+iIU/ih2kPsICVyOkpZMk2D1 iTo4igUfaDL17IcTy+jfbwfmMqbxFl1LY18i127nqWXa2qUg5alZZwxBeubtRtijFj28A Hxzd1EdfOYQ8G30ofytnXw/azx1yVNQnQGHfkiNUf52qvIdwCPITYtrmP0FQOQmIaYoIU MiUb1EpjGKjNaaTDcJlagJuskLdF25VFshqaROV/I0W9d4KoprsFBrWmSTpK1WzWw3Dxd hSmu/0/zdc+qE+kBD2gV4QEpWoysv80H6WHZBdt1ZRJODzRwTLGdKowbIjnfBC3Wgig== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=CTf5jRoh; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 321F3606AC3A; Wed, 4 Nov 2026 22:28:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=CTf5jRoh Received: by smtp.kernel.org (Postfix) with ESMTPSA id D59BA1F00919; Wed, 4 Nov 2026 22:28:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793831304; bh=ahsRJtaFsLtPHBaUPqEjPjQ8t2rSujJN7LMITHy06ps=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CTf5jRohBO9UbZMRIZQbCW3WnpxKLN9YEbWadm32HKorMqiOCnpFPyOH14GHlYgaW +KmsC0JyFY55EG0D1igxEOy9yDtZ4TsHcDHbDDpdN5LaWPf6cR6YmhYEYTNCX+X4ie HktcrWP0CE+wLSiLUNvn2XMIkZO4/iuiADXVQcvk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Pengpeng Hou , Steven Rostedt , Sasha Levin Subject: [PATCH 6.18 0621/1005] tracing: Bound histogram expression strings with seq_buf Date: Wed, 4 Nov 2026 16:05:54 -0500 Message-ID: <20261104211101.211977541@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104211043.516122098@linuxfoundation.org> References: <20261104211043.516122098@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pengpeng Hou [ Upstream commit 935601a4276f28105498609f7f98aa66e86e9c96 ] expr_str() allocates a fixed MAX_FILTER_STR_VAL buffer and then builds expression names with a series of raw strcat() appends. Nested operands, constants, field flags, and generated field names can push the rendered string past that fixed limit before the name is attached to the hist field. Build expression strings with seq_buf and return -E2BIG when the rendered name would exceed MAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while replacing the raw append logic with bounded construction. Link: https://patch.msgid.link/20260611055945.22348-4-pengpeng@iscas.ac.cn Signed-off-by: Pengpeng Hou Signed-off-by: Steven Rostedt Stable-dep-of: a0777b9e5315 ("tracing: Fix NULL dereference when copying keys for a field variable") Signed-off-by: Sasha Levin --- kernel/trace/trace_events_hist.c | 57 ++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 24 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 511548b75ad89..086a996c945b4 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -94,7 +94,6 @@ typedef u64 (*hist_field_fn_t) (struct hist_field *field, #define HIST_FIELD_OPERANDS_MAX 2 #define HIST_FIELDS_MAX (TRACING_MAP_FIELDS_MAX + TRACING_MAP_VARS_MAX) #define HIST_ACTIONS_MAX 8 -#define HIST_CONST_DIGITS_MAX 21 #define HIST_DIV_SHIFT 20 /* For optimizing division by constants */ enum field_op_id { @@ -1735,33 +1734,36 @@ static const char *get_hist_field_flags(struct hist_field *hist_field) return flags_str; } -static void expr_field_str(struct hist_field *field, char *expr) +static bool expr_field_str(struct hist_field *field, struct seq_buf *s) { + const char *field_name; + if (field->flags & HIST_FIELD_FL_VAR_REF) { if (!field->system) - strcat(expr, "$"); - } else if (field->flags & HIST_FIELD_FL_CONST) { - char str[HIST_CONST_DIGITS_MAX]; + seq_buf_putc(s, '$'); + } else if (field->flags & HIST_FIELD_FL_CONST) + seq_buf_printf(s, "%llu", field->constant); - snprintf(str, HIST_CONST_DIGITS_MAX, "%llu", field->constant); - strcat(expr, str); - } + field_name = hist_field_name(field, 0); + if (!field_name) + return false; - strcat(expr, hist_field_name(field, 0)); + seq_buf_puts(s, field_name); if (field->flags && !(field->flags & HIST_FIELD_FL_VAR_REF)) { const char *flags_str = get_hist_field_flags(field); - if (flags_str) { - strcat(expr, "."); - strcat(expr, flags_str); - } + if (flags_str) + seq_buf_printf(s, ".%s", flags_str); } + + return !seq_buf_has_overflowed(s); } static char *expr_str(struct hist_field *field, unsigned int level) { char *expr __free(kfree) = NULL; + struct seq_buf s; if (level > 1) return ERR_PTR(-EINVAL); @@ -1770,47 +1772,54 @@ static char *expr_str(struct hist_field *field, unsigned int level) if (!expr) return ERR_PTR(-ENOMEM); + seq_buf_init(&s, expr, MAX_FILTER_STR_VAL); + if (!field->operands[0]) { - expr_field_str(field, expr); + if (!expr_field_str(field, &s)) + return ERR_PTR(-E2BIG); + return_ptr(expr); } if (field->operator == FIELD_OP_UNARY_MINUS) { char *subexpr; - strcat(expr, "-("); subexpr = expr_str(field->operands[0], ++level); if (IS_ERR(subexpr)) return subexpr; - strcat(expr, subexpr); - strcat(expr, ")"); - + seq_buf_printf(&s, "-(%s)", subexpr); kfree(subexpr); + if (seq_buf_has_overflowed(&s)) + return ERR_PTR(-E2BIG); + return_ptr(expr); } - expr_field_str(field->operands[0], expr); + if (!expr_field_str(field->operands[0], &s)) + return ERR_PTR(-E2BIG); switch (field->operator) { case FIELD_OP_MINUS: - strcat(expr, "-"); + seq_buf_putc(&s, '-'); break; case FIELD_OP_PLUS: - strcat(expr, "+"); + seq_buf_putc(&s, '+'); break; case FIELD_OP_DIV: - strcat(expr, "/"); + seq_buf_putc(&s, '/'); break; case FIELD_OP_MULT: - strcat(expr, "*"); + seq_buf_putc(&s, '*'); break; default: return ERR_PTR(-EINVAL); } - expr_field_str(field->operands[1], expr); + if (seq_buf_has_overflowed(&s) || + !expr_field_str(field->operands[1], &s)) + return ERR_PTR(-E2BIG); return_ptr(expr); } -- 2.53.0