On Wed, 22 Jul 2026 14:10:40 +0800
Li Qiang <[email protected]> wrote:
> parse_entry() appends dynamic string data by adding its length to the
> current entry size. An oversized input can overflow this signed addition,
> cause krealloc() to receive too small a length, and then write beyond it.
>
> Reject a string length that cannot be added to entry_size before growing
> the allocation.
>
> Fixes: 6c3edaf9fd6a ("tracing: Introduce trace event injection")
> Cc: [email protected]
> Signed-off-by: Li Qiang <[email protected]>
> ---
> kernel/trace/trace_events_inject.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/kernel/trace/trace_events_inject.c
> b/kernel/trace/trace_events_inject.c
> index b8b141c00d5c..5c551def44f6 100644
> --- a/kernel/trace/trace_events_inject.c
> +++ b/kernel/trace/trace_events_inject.c
> @@ -243,6 +243,9 @@ static int parse_entry(char *str, struct trace_event_call
> *call, void **pentry)
> int str_loc = entry_size & 0xffff;
> u32 *str_item;
>
> + if (str_len > INT_MAX - entry_size)
> + return -E2BIG;
This is just wrong in so many ways that it shows that you don't understand
the code.
-- Steve
> +
> entry_size += str_len;
> *pentry = krealloc(entry, entry_size,
> GFP_KERNEL);
> if (!*pentry) {
