# Re: \[PATCH v3 02/16\] tracing/filters: Fix MATCH\_END\_ONLY regex matching for fixed-size strings

- From: Masami Hiramatsu (Google) \<mhiramat@kernel.org\>
- Date: 2026-10-28 01:36:36 
- List: linux-trace-kernel
- Page: https://ratatoskr.run/linux-trace-kernel/2026/10/17814147
- Thread: https://ratatoskr.run/linux-trace-kernel/2026/10/17814009/t.md

```text
On Wed, 28 Oct 2026 01:05:18 +0000, sashiko-bot@kernel.org [ref] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] tracing/filters: unhandled zero len in regex_match_end_str()
> --
> 
> commit 92251abf42afdb93bef9298fec46088f078a4aa8
> Author: Masami Hiramatsu (Google) [ref]
> 
> tracing/filters: Fix MATCH_END_ONLY regex matching for fixed-size strings
> 
> This commit introduces regex_match_end_str() to handle suffix regex matching
> on fixed-size string buffers using strnlen(), and assigns it in parse_pred()
> for comm and static string fields.
> 
> > diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
> > index 59a0d3ba72740..f7c067a58ba41 100644
> > --- a/kernel/trace/trace_events_filter.c
> > +++ b/kernel/trace/trace_events_filter.c
> > @@ -1087,6 +1087,20 @@ static int regex_match_end(char *str, struct regex *r, int len)
> >  	return 0;
> >  }
> >  
> > +static int regex_match_end_str(char *str, struct regex *r, int len)
> > +{
> > +	int slen;
> > +
> > +	if (len < r->len)
> > +		return 0;
> > +
> > +	slen = strnlen(str, len);
> > +	if (slen >= r->len &&
> > +	    memcmp(str + slen - r->len, r->pattern, r->len) == 0)
> > +		return 1;
> > +	return 0;
> > +}
> 
> [Severity: Medium]
> How does regex_match_end_str() behave when len is 0?
> 
> For the ftrace/print event, the buf field is defined in
> kernel/trace/trace_export.c with a size of 0:
> 
> #undef __dynamic_array
> #define __dynamic_array(_type, _item) {					\
> 	.type = #_type "[]", .name = #_item,				\
> 	.size = 0, .align = __alignof__(_type),				\
> 	is_signed_type(_type), .filter_type = FILTER_OTHER },
> 
> Because its type is "char[]", filter_assign_type() classifies it as a static
> string field while field->size remains 0. In parse_pred(),
> pred->regex->field_len is set to field->size (0) and pred->regex->match is
> set to regex_match_end_str():
> 
> 		} else if (field->filter_type == FILTER_STATIC_STRING) {
> 			pred->fn_num = FILTER_PRED_FN_STRING;
> 			pred->regex->field_len = field->size;
> 			if (pred->regex->match == regex_match_end)
> 				pred->regex->match = regex_match_end_str;
> 
> When a trigger or eprobe with a suffix filter (such as buf ~ "*foo") is
> evaluated via write_marker_to_buffer() -> event_triggers_call() ->
> filter_match_preds() -> filter_pred_string(), regex_match_end_str() is called
> with len == 0.

Good catch... this may be yet another issue.

I think we need another different set of matching functions for dynamic
string. Sharing it with static string (where len = 0 means zero length)
and dynamic string (where len = 0 means variable length string) is
a bad idea.

> 
> As noted in the comment above regex_match_full() (added in commit
> 10f20e9f9da9 ("tracing: Have zero size length in filter logic be full
> string")), a len of zero indicates that str is a NUL-terminated string, which
> regex_match_full(), regex_match_front(), and regex_match_middle() handle
> explicitly:
> 
> static int regex_match_full(char *str, struct regex *r, int len)
> {
> 	/* len of zero means str is dynamic and ends with '\0' */
> 	if (!len)
> 		return strcmp(str, r->pattern) == 0;
> 
> In regex_match_end_str(), however, when len is 0, the (len < r->len) check
> returns 0 for any non-empty pattern, and strnlen(str, 0) also returns 0.
> 
> Should regex_match_end_str() check for !len and use strlen(str) in that case,
> so that suffix filters on ftrace/print work as expected?

I rather like to have regex_match_end_dynstr() in this case.

Anyway, we should have a unit test for filters.

Thanks,

-- 
Masami Hiramatsu (Google) [ref]
```