From nobody Fri Jul 24 23:31:27 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 138EB33B6DC; Wed, 22 Jul 2026 06:11:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784700675; cv=none; b=k44xD1aA2mPjpQUsaUUnLvqyAZ/6TiNWqld4az2CRk+wKpY71Fg3JrLXrgU9lqPKcOMb7Qv2/KNJYkPXu13GKwviCVX2vUFVYHTtLDVHXH81iYnQsr7fHr77QUmYP32BmMNbpfRc57ueX2rdf/nM0k/weWkhBJ9hFZy4luzzAPA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784700675; c=relaxed/simple; bh=aK88JeHoSp3zjTatGviKfa3rpJW4LZZv4zXhClJNACI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TXzzEkfh2JU2TEou6oxLktHlssUBZ1LxuqP6BKVHoXvIj5KB08PpNRjWnjhZKqCUixMCZTcbRAIsXEveS4O04iHP/zASyY7g1o4gX99epMmgPLVXF/4h8fDDcvtkRPsHfxBqhUU5U91Vd88tFz+B58+u12+IldV1c2gbuuBMOvU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 1d72d312859411f1aa26b74ffac11d73-20260722 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_DIGIT_LEN HR_FROM_NAME, HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED SA_TRUSTED, SA_EXISTED, SN_TRUSTED, SN_EXISTED, SPF_NOPASS DKIM_NOPASS, DMARC_NOPASS, CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS GTI_RG_INFO, GTI_C_BU, AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:63bfb3db-28ae-4e6e-bd9a-aae3c5fd195c,IP:15, URL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:15 X-CID-INFO: VERSION:1.3.12,REQID:63bfb3db-28ae-4e6e-bd9a-aae3c5fd195c,IP:15,UR L:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION:r elease,TS:15 X-CID-META: VersionHash:e7bac3a,CLOUDID:129ab0f01193ae5a0ff8df994114b601,BulkI D:260722141104QYMZ1CUH,BulkQuantity:0,Recheck:0,SF:10|38|66|78|81|82|102|1 27|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk: nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,B RE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 1d72d312859411f1aa26b74ffac11d73-20260722 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 209540309; Wed, 22 Jul 2026 14:11:02 +0800 From: Li Qiang To: rostedt@goodmis.org, mhiramat@kernel.org Cc: linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org, Li Qiang , stable@vger.kernel.org Subject: [PATCH 1/4] tracing/hist: Prevent overflow in histogram expression strings Date: Wed, 22 Jul 2026 14:10:37 +0800 Message-ID: <20260722061040.112747-2-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722061040.112747-1-liqiang01@kylinos.cn> References: <20260722061040.112747-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" expr_str() builds a histogram expression in a fixed-size MAX_FILTER_STR_VAL allocation with unbounded strcat() calls. Synthetic events permit field names longer than that buffer. Constructing a trigger expression can therefore write past the allocation. Build the expression with seq_buf. Propagate construction errors to the parser and reject strings that overflow the fixed-size buffer with -E2BIG. Fixes: 100719dcef44 ("tracing: Add simple expression support to hist trigge= rs") Cc: stable@vger.kernel.org Signed-off-by: Li Qiang --- kernel/trace/trace_events_hist.c | 89 +++++++++++++++++++++----------- 1 file changed, 59 insertions(+), 30 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 82ce492ab268..2b2547546360 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -1733,86 +1733,99 @@ static const char *get_hist_field_flags(struct hist= _field *hist_field) return flags_str; } =20 -static void expr_field_str(struct hist_field *field, char *expr) +static void expr_field_str(struct hist_field *field, struct seq_buf *s) { if (field->flags & HIST_FIELD_FL_VAR_REF) { if (!field->system) - strcat(expr, "$"); + seq_buf_putc(s, '$'); } else if (field->flags & HIST_FIELD_FL_CONST) { char str[HIST_CONST_DIGITS_MAX]; =20 snprintf(str, HIST_CONST_DIGITS_MAX, "%llu", field->constant); - strcat(expr, str); + seq_buf_puts(s, str); } =20 - strcat(expr, hist_field_name(field, 0)); + seq_buf_puts(s, hist_field_name(field, 0)); =20 if (field->flags && !(field->flags & HIST_FIELD_FL_VAR_REF)) { const char *flags_str =3D get_hist_field_flags(field); =20 if (flags_str) { - strcat(expr, "."); - strcat(expr, flags_str); + seq_buf_putc(s, '.'); + seq_buf_puts(s, flags_str); } } } =20 static char *expr_str(struct hist_field *field, unsigned int level) { + struct seq_buf s; char *expr; + int ret =3D 0; =20 if (level > 1) - return NULL; + return ERR_PTR(-EINVAL); =20 expr =3D kzalloc(MAX_FILTER_STR_VAL, GFP_KERNEL); if (!expr) - return NULL; + return ERR_PTR(-ENOMEM); + + seq_buf_init(&s, expr, MAX_FILTER_STR_VAL); =20 if (!field->operands[0]) { - expr_field_str(field, expr); - return expr; + expr_field_str(field, &s); + goto out; } =20 if (field->operator =3D=3D FIELD_OP_UNARY_MINUS) { char *subexpr; =20 - strcat(expr, "-("); + seq_buf_puts(&s, "-("); subexpr =3D expr_str(field->operands[0], ++level); - if (!subexpr) { - kfree(expr); - return NULL; + if (IS_ERR(subexpr)) { + ret =3D PTR_ERR(subexpr); + goto free; } - strcat(expr, subexpr); - strcat(expr, ")"); + seq_buf_puts(&s, subexpr); + seq_buf_putc(&s, ')'); =20 kfree(subexpr); - - return expr; + goto out; } =20 - expr_field_str(field->operands[0], expr); + expr_field_str(field->operands[0], &s); =20 switch (field->operator) { case FIELD_OP_MINUS: - strcat(expr, "-"); + seq_buf_putc(&s, '-'); break; case FIELD_OP_PLUS: - strcat(expr, "+"); + seq_buf_putc(&s, '+'); break; case FIELD_OP_DIV: - strcat(expr, "/"); + seq_buf_putc(&s, '/'); break; case FIELD_OP_MULT: - strcat(expr, "*"); + seq_buf_putc(&s, '*'); break; default: - kfree(expr); - return NULL; + ret =3D -EINVAL; + goto free; } =20 - expr_field_str(field->operands[1], expr); + expr_field_str(field->operands[1], &s); =20 +out: + seq_buf_str(&s); + if (seq_buf_has_overflowed(&s)) { + ret =3D -E2BIG; + goto free; + } return expr; + +free: + kfree(expr); + return ERR_PTR(ret); } =20 /* @@ -2556,6 +2569,7 @@ static struct hist_field *parse_unary(struct hist_tri= gger_data *hist_data, char *var_name, unsigned int *n_subexprs) { struct hist_field *operand1, *expr =3D NULL; + char *expr_name; unsigned long operand_flags; int ret =3D 0; char *s; @@ -2625,7 +2639,12 @@ static struct hist_field *parse_unary(struct hist_tr= igger_data *hist_data, expr->size =3D operand1->size; expr->is_signed =3D operand1->is_signed; expr->operator =3D FIELD_OP_UNARY_MINUS; - expr->name =3D expr_str(expr, 0); + expr_name =3D expr_str(expr, 0); + if (IS_ERR(expr_name)) { + ret =3D PTR_ERR(expr_name); + goto free; + } + expr->name =3D expr_name; expr->type =3D kstrdup_const(operand1->type, GFP_KERNEL); if (!expr->type) { ret =3D -ENOMEM; @@ -2691,7 +2710,7 @@ static struct hist_field *parse_expr(struct hist_trig= ger_data *hist_data, struct hist_field *var1 =3D NULL, *var2 =3D NULL; unsigned long operand_flags, operand2_flags; int field_op, ret =3D -EINVAL; - char *sep, *operand1_str; + char *expr_name, *sep, *operand1_str; enum hist_field_fn op_fn; bool combine_consts; =20 @@ -2837,7 +2856,12 @@ static struct hist_field *parse_expr(struct hist_tri= gger_data *hist_data, destroy_hist_field(operand2, 0); destroy_hist_field(operand1, 0); =20 - expr->name =3D expr_str(expr, 0); + expr_name =3D expr_str(expr, 0); + if (IS_ERR(expr_name)) { + ret =3D PTR_ERR(expr_name); + goto free_expr; + } + expr->name =3D expr_name; } else { /* The operand sizes should be the same, so just pick one */ expr->size =3D operand1->size; @@ -2850,7 +2874,12 @@ static struct hist_field *parse_expr(struct hist_tri= gger_data *hist_data, goto free_expr; } =20 - expr->name =3D expr_str(expr, 0); + expr_name =3D expr_str(expr, 0); + if (IS_ERR(expr_name)) { + ret =3D PTR_ERR(expr_name); + goto free_expr; + } + expr->name =3D expr_name; } =20 return expr; --=20 2.43.0 From nobody Fri Jul 24 23:31:27 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B0C433CE88; Wed, 22 Jul 2026 06:11:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784700685; cv=none; b=pqrkN/e+SEZhwENJY2T/98Us+vLF5pWjgwttYgyjeCIoDwQVTbg48psnM1R5TpSDcpogV7/0QyuUcgdNNhKKLEhYnFFhhngv9TQD811SpV69xpIRECu1Rz5uOu7CuzsNiTUmVF2IGBzaslranxxDaWmA9AFMcSJ+aBKMobpvQSw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784700685; c=relaxed/simple; bh=+zn/5rUSOI5tYr8quJd5cp90NOxeBxcuK0kJejW29TE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uShxsI0dWktuik0UNFiB5C20bTreBYPejWRBtqpxbbushLVt+WuchHQ5oJDkry5zwAEDzNQCPep7KlqSTYs97Kvg8EJdfjtSRKGGF8yl9oHIKsqlL/rW76SQU/+HJNJ2hUxjPbfKifixQHVFHAiH9aUxNi0X2d1tv78yXl1Lnpo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 1db3728c859411f1aa26b74ffac11d73-20260722 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_DIGIT_LEN HR_FROM_NAME, HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED SA_TRUSTED, SA_EXISTED, SN_TRUSTED, SN_EXISTED, SPF_NOPASS DKIM_NOPASS, DMARC_NOPASS, CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS GTI_RG_INFO, GTI_C_BU, AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:2b55ebc4-2908-492b-a6e7-256b568d63c8,IP:15, URL:0,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:10 X-CID-INFO: VERSION:1.3.12,REQID:2b55ebc4-2908-492b-a6e7-256b568d63c8,IP:15,UR L:0,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:10 X-CID-META: VersionHash:e7bac3a,CLOUDID:85ad491d20fb8871bef74b04f5fd984d,BulkI D:260722141104YKRMTDY1,BulkQuantity:0,Recheck:0,SF:10|38|66|78|81|82|102|1 27|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk: nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,B RE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 1db3728c859411f1aa26b74ffac11d73-20260722 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1371682131; Wed, 22 Jul 2026 14:11:02 +0800 From: Li Qiang To: rostedt@goodmis.org, mhiramat@kernel.org Cc: linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org, Li Qiang , stable@vger.kernel.org Subject: [PATCH 2/4] tracing/user_events: Validate explicit struct field sizes Date: Wed, 22 Jul 2026 14:10:38 +0800 Message-ID: <20260722061040.112747-3-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722061040.112747-1-liqiang01@kylinos.cn> References: <20260722061040.112747-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" User event declarations permit an explicit size for a struct field. The parser accumulated that size in an unsigned offset, then assigned the parsed unsigned value directly to signed field metadata. Oversized declarations or cumulative offsets could wrap or become invalid signed values. Validate an explicit size is representable as int before storing it. Keep the running offset signed and reject additions exceeding INT_MAX, so invalid field layouts are rejected during declaration parsing. Fixes: 7f5a08c79df3 ("user_events: Add minimal support for trace_event into= ftrace") Cc: stable@vger.kernel.org Signed-off-by: Li Qiang --- kernel/trace/trace_events_user.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_u= ser.c index 8c82ecb735f4..fd5b3946921c 100644 --- a/kernel/trace/trace_events_user.c +++ b/kernel/trace/trace_events_user.c @@ -1197,10 +1197,12 @@ static int user_event_add_field(struct user_event *= user, const char *type, * Format: type name [size] */ static int user_event_parse_field(char *field, struct user_event *user, - u32 *offset) + int *offset) { char *part, *type, *name; - u32 depth =3D 0, saved_offset =3D *offset; + u32 depth =3D 0; + unsigned int field_size; + int saved_offset =3D *offset; int len, size =3D -EINVAL; bool is_struct =3D false; =20 @@ -1261,8 +1263,11 @@ static int user_event_parse_field(char *field, struc= t user_event *user, if (!is_struct) return -EINVAL; =20 - if (kstrtou32(part, 10, &size)) + if (kstrtouint(part, 10, &field_size)) return -EINVAL; + if (field_size > INT_MAX) + return -E2BIG; + size =3D field_size; break; default: return -EINVAL; @@ -1281,6 +1286,9 @@ static int user_event_parse_field(char *field, struct= user_event *user, if (size < 0) return size; =20 + if (size > INT_MAX - saved_offset) + return -E2BIG; + *offset =3D saved_offset + size; =20 return user_event_add_field(user, type, name, saved_offset, size, @@ -1290,7 +1298,7 @@ static int user_event_parse_field(char *field, struct= user_event *user, static int user_event_parse_fields(struct user_event *user, char *args) { char *field; - u32 offset =3D sizeof(struct trace_entry); + int offset =3D sizeof(struct trace_entry); int ret =3D -EINVAL; =20 if (args =3D=3D NULL) --=20 2.43.0 From nobody Fri Jul 24 23:31:27 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B0382DF701; Wed, 22 Jul 2026 06:11:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784700674; cv=none; b=PDH5wlNQYH9vh2Fn1fUZLaREWnPmAAeqFA7Nv9C60PcG3ixscTLZaC1zahe47VJrCopXkBV5reD+SOXlz9fudgk7ilOrzeBpWjJ2SYXuJBSJa+nE1WEDjRqRyMt20ldhPQn/lq0HkPwbv5VEzTPwVgoI7rKFDc1AsGlx3mtmQHU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784700674; c=relaxed/simple; bh=v42dRaKxj1LsLC3QU9XKtSklSxvImei3dJ0Hk/QeXXY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qzQ6+R2OdMblaA3KjkFe5BxshKRnCt18bEJW+PrHpHp29aZ8L3cI37Gel6wBN6khmsSjOWVPgL4TO6Wfqp3ryMIpTcLSakTMhuK9yd+00WY0ILWxKSYWtJSCCWJWLv1V+D4UnEN+82r+K9eCoVKDCrz82G+4xQHgts1tGgNmlv8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 1df87602859411f1aa26b74ffac11d73-20260722 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_DIGIT_LEN HR_FROM_NAME, HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED SA_TRUSTED, SA_EXISTED, SN_TRUSTED, SN_EXISTED, SPF_NOPASS DKIM_NOPASS, DMARC_NOPASS, CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS GTI_RG_INFO, GTI_C_BU, AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:b2333f70-c98a-4683-902e-70041ac3bce2,IP:15, URL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:15 X-CID-INFO: VERSION:1.3.12,REQID:b2333f70-c98a-4683-902e-70041ac3bce2,IP:15,UR L:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION:r elease,TS:15 X-CID-META: VersionHash:e7bac3a,CLOUDID:123d66af32c07acc495e82e37f3d4d4b,BulkI D:260722141104NCY3GOCL,BulkQuantity:0,Recheck:0,SF:10|38|66|78|81|82|102|1 27|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk: nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,B RE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 1df87602859411f1aa26b74ffac11d73-20260722 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 639850921; Wed, 22 Jul 2026 14:11:02 +0800 From: Li Qiang To: rostedt@goodmis.org, mhiramat@kernel.org Cc: linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org, Li Qiang , stable@vger.kernel.org Subject: [PATCH 3/4] tracing/inject: Validate entry allocation size Date: Wed, 22 Jul 2026 14:10:39 +0800 Message-ID: <20260722061040.112747-4-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722061040.112747-1-liqiang01@kylinos.cn> References: <20260722061040.112747-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" trace_get_entry_size() calculated the allocation from signed field offsets and sizes without validating their sum. A malformed event could use a negative range or overflow the calculation, allocate too little memory, and then write past it while initializing or populating the entry. Events with no fields also allocated less than a trace_entry. Start at sizeof(struct trace_entry), validate each field range, and reserve room for the trailing NUL. Propagate sizing errors to parse_entry() before it initializes the allocation. Fixes: 6c3edaf9fd6a ("tracing: Introduce trace event injection") Cc: stable@vger.kernel.org Signed-off-by: Li Qiang --- kernel/trace/trace_events_inject.c | 31 ++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace_events_inject.c b/kernel/trace/trace_events= _inject.c index a8f076809db4..b8b141c00d5c 100644 --- a/kernel/trace/trace_events_inject.c +++ b/kernel/trace/trace_events_inject.c @@ -135,27 +135,43 @@ parse_field(char *str, struct trace_event_call *call, return -EINVAL; } =20 -static int trace_get_entry_size(struct trace_event_call *call) +static int trace_get_entry_size(struct trace_event_call *call, int *entry_= size) { struct ftrace_event_field *field; struct list_head *head; - int size =3D 0; + int field_size; + int size =3D sizeof(struct trace_entry); =20 head =3D trace_get_fields(call); list_for_each_entry(field, head, link) { - if (field->size + field->offset > size) - size =3D field->size + field->offset; + if (field->offset < 0 || field->size < 0 || + field->size > INT_MAX - field->offset) + return -E2BIG; + + field_size =3D field->size + field->offset; + if (field_size > size) + size =3D field_size; } =20 - return size; + /* trace_alloc_entry() reserves an extra NUL byte. */ + if (size =3D=3D INT_MAX) + return -E2BIG; + + *entry_size =3D size; + return 0; } =20 static void *trace_alloc_entry(struct trace_event_call *call, int *size) { - int entry_size =3D trace_get_entry_size(call); + int entry_size; struct ftrace_event_field *field; struct list_head *head; void *entry =3D NULL; + int ret; + + ret =3D trace_get_entry_size(call, &entry_size); + if (ret) + return ERR_PTR(ret); =20 /* We need an extra '\0' at the end. */ entry =3D kzalloc(entry_size + 1, GFP_KERNEL); @@ -202,6 +218,9 @@ static int parse_entry(char *str, struct trace_event_ca= ll *call, void **pentry) int len; =20 entry =3D trace_alloc_entry(call, &entry_size); + if (IS_ERR(entry)) + return PTR_ERR(entry); + *pentry =3D entry; if (!entry) return -ENOMEM; --=20 2.43.0 From nobody Fri Jul 24 23:31:27 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 502D533AD9C; Wed, 22 Jul 2026 06:11:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784700673; cv=none; b=d2uwHmaTqpFs4BVbY11l47ryr85DZSZdGI9CQljg0vljtuFYzdLiEXRlDLHD+dQoqnCGoqWVS+nHWkoSLGvQB1OStBTdJUoUuDMR4Mgr2XSyy3spR3jHShR+McCHhOhxiq9FvSBHAaXaeyU1hCrGl1ewWzNLX+ZlLGe+IK9lz4g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784700673; c=relaxed/simple; bh=CFoa86Uz74036+ICkody/I2OxfctQjO/9BLPIQ5LRAo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=k3s0QZ5aeilK+/CgSjWASHIMBmIi0GIGUiTU0D6g1kZ016I9H9abw1g4ShlrPyQQI9UCeoGJ/nolTMyse6Nq/S0Iv+A5v24bnSScKbI+R9C7cUF06mTbCorLcv8Rd4SqvchaKgeOqqtbQ3ZB8srf2HKM8cpQy9l8tjdLkoLwM3k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 1e608648859411f1aa26b74ffac11d73-20260722 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NAME, HR_CC_NO_NAME, HR_CTE_8B HR_CTT_MISS, HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_DIGIT_LEN HR_FROM_NAME, HR_SJ_DIGIT_LEN, HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER HR_SJ_NOR_SYM, HR_SJ_PHRASE, HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME, IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED SA_TRUSTED, SA_EXISTED, SN_TRUSTED, SN_EXISTED, SPF_NOPASS DKIM_NOPASS, DMARC_NOPASS, CIE_GOOD, CIE_GOOD_SPF, GTI_FG_BS GTI_RG_INFO, GTI_C_BU, AMN_GOOD, ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:ecca982b-22f2-402a-b663-c839365519de,IP:15, URL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:15 X-CID-INFO: VERSION:1.3.12,REQID:ecca982b-22f2-402a-b663-c839365519de,IP:15,UR L:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION:r elease,TS:15 X-CID-META: VersionHash:e7bac3a,CLOUDID:2820e7ca4246b2fd5fbd1793db7675a5,BulkI D:260722141104DLVJ7E1R,BulkQuantity:0,Recheck:0,SF:10|38|66|78|81|82|102|1 27|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk: nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,B RE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 1e608648859411f1aa26b74ffac11d73-20260722 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1606383993; Wed, 22 Jul 2026 14:11:03 +0800 From: Li Qiang To: rostedt@goodmis.org, mhiramat@kernel.org Cc: linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org, Li Qiang , stable@vger.kernel.org Subject: [PATCH 4/4] tracing/inject: Prevent overflow growing string fields Date: Wed, 22 Jul 2026 14:10:40 +0800 Message-ID: <20260722061040.112747-5-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260722061040.112747-1-liqiang01@kylinos.cn> References: <20260722061040.112747-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" parse_entry() appends dynamic string data by adding its length to the current entry size. An oversized input can overflow this signed addition, cause krealloc() to receive too small a length, and then write beyond it. Reject a string length that cannot be added to entry_size before growing the allocation. Fixes: 6c3edaf9fd6a ("tracing: Introduce trace event injection") Cc: stable@vger.kernel.org Signed-off-by: Li Qiang --- kernel/trace/trace_events_inject.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace_events_inject.c b/kernel/trace/trace_events= _inject.c index b8b141c00d5c..5c551def44f6 100644 --- a/kernel/trace/trace_events_inject.c +++ b/kernel/trace/trace_events_inject.c @@ -243,6 +243,9 @@ static int parse_entry(char *str, struct trace_event_ca= ll *call, void **pentry) int str_loc =3D entry_size & 0xffff; u32 *str_item; =20 + if (str_len > INT_MAX - entry_size) + return -E2BIG; + entry_size +=3D str_len; *pentry =3D krealloc(entry, entry_size, GFP_KERNEL); if (!*pentry) { --=20 2.43.0