Re: [PATCH 1/4] tracing/hist: Prevent overflow in histogram expression strings
From: Steven Rostedt <rostedt@goodmis.org>
Date: 2026-07-22 16:31:57
Also in:
lkml, stable
On Wed, 22 Jul 2026 14:10:37 +0800 Li Qiang [off-list ref] wrote:
expr_str() builds a histogram expression in a fixed-size
MAX_FILTER_STR_VAL allocation with unbounded strcat() calls.
Synthetic events permit field names longer than that buffer. Constructing
a trigger expression can therefore write past the allocation.
Build the expression with seq_buf. Propagate construction errors to the
parser and reject strings that overflow the fixed-size buffer with -E2BIG.
Fixes: 100719dcef44 ("tracing: Add simple expression support to hist triggers")
Cc: stable@vger.kernel.org
Signed-off-by: Li Qiang <redacted>This has been fixed by this: https://patch.msgid.link/20260611055945.22348-4-pengpeng@iscas.ac.cn Since it can only be updated by root, I didn't not add a fixes nor a stable tag and will be sending it in the next merge window (I haven't updated my linux-next branch, but will soon) -- Steve