Re: [PATCH 4/4] tracing/inject: Prevent overflow growing string fields

[Steven Rostedt <rostedt@goodmis.org>]

On Wed, 22 Jul 2026 14:10:40 +0800
Li Qiang <liqiang01@kylinos.cn> wrote:

> parse_entry() appends dynamic string data by adding its length to the
> current entry size. An oversized input can overflow this signed addition,
> cause krealloc() to receive too small a length, and then write beyond it.
> 
> Reject a string length that cannot be added to entry_size before growing
> the allocation.
> 
> Fixes: 6c3edaf9fd6a ("tracing: Introduce trace event injection")
> Cc: stable@vger.kernel.org
> Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
> ---
>  kernel/trace/trace_events_inject.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/kernel/trace/trace_events_inject.c b/kernel/trace/trace_events_inject.c
> index b8b141c00d5c..5c551def44f6 100644
> --- a/kernel/trace/trace_events_inject.c
> +++ b/kernel/trace/trace_events_inject.c
> @@ -243,6 +243,9 @@ static int parse_entry(char *str, struct trace_event_call *call, void **pentry)
>  				int str_loc = entry_size & 0xffff;
>  				u32 *str_item;
>  
> +				if (str_len > INT_MAX - entry_size)
> +					return -E2BIG;

This is just wrong in so many ways that it shows that you don't understand
the code.

-- Steve

> +
>  				entry_size += str_len;
>  				*pentry = krealloc(entry, entry_size, GFP_KERNEL);
>  				if (!*pentry) {