# Re: \[PATCH 01/10\] tracing/filters: Fix MATCH\_END\_ONLY regex matching for fixed-size strings

- From: Masami Hiramatsu (Google) \<mhiramat@kernel.org\>
- Date: 2026-10-25 02:11:57 
- List: linux-trace-kernel
- Page: https://ratatoskr.run/linux-trace-kernel/2026/10/17799303
- Thread: https://ratatoskr.run/linux-trace-kernel/2026/10/17798524/t.md

```text
On Sat, 24 Oct 2026 17:02:09 +0000, sashiko-bot@kernel.org [ref] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] tracing/filters: out-of-bounds read in regex_match_end() when len is 0
> --
> 
> commit 1023475f1fd5bcb5e8b46a2be2fb9fe7ea16d624
> Author: Masami Hiramatsu (Google) [ref]
> 
> tracing/filters: Fix MATCH_END_ONLY regex matching for fixed-size strings
> 
> This commit updates regex_match_end() to compute string length via strnlen()
> when len is non-zero and strlen() when len is zero, fixing suffix filter
> matching on fixed-size and dynamic string fields.
> 
> > diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
> > index 5e74d2dae40a3..18ce3ec00d34f 100644
> > --- a/kernel/trace/trace_events_filter.c
> > +++ b/kernel/trace/trace_events_filter.c
> > @@ -1075,10 +1075,10 @@ static int regex_match_middle(char *str, struct regex *r, int len)
> >  
> >  static int regex_match_end(char *str, struct regex *r, int len)
> >  {
> > -	int strlen = len - 1;
> > +	int slen = len ? strnlen(str, len) : strlen(str);
> 
> [Severity: High]
> Can calling strlen(str) when len == 0 cause an out-of-bounds read past the
> end of the trace event record?

Ah, good catch! Indeed. len == 0 means it is 0. Ok, let's fix it.
(maybe we should also reject len < 0 for safety?)

Thanks,

-- 
Masami Hiramatsu (Google) [ref]

```