On Sat, 24 Oct 2026 17:02:09 +0000, [email protected] <[email protected]> wrote: > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) > to consider: > - [High] tracing/filters: out-of-bounds read in regex_match_end() when len is > 0 > -- > > commit 1023475f1fd5bcb5e8b46a2be2fb9fe7ea16d624 > Author: Masami Hiramatsu (Google) <[email protected]> > > tracing/filters: Fix MATCH_END_ONLY regex matching for fixed-size strings > > This commit updates regex_match_end() to compute string length via strnlen() > when len is non-zero and strlen() when len is zero, fixing suffix filter > matching on fixed-size and dynamic string fields. > > > diff --git a/kernel/trace/trace_events_filter.c > > b/kernel/trace/trace_events_filter.c > > index 5e74d2dae40a3..18ce3ec00d34f 100644 > > --- a/kernel/trace/trace_events_filter.c > > +++ b/kernel/trace/trace_events_filter.c > > @@ -1075,10 +1075,10 @@ static int regex_match_middle(char *str, struct > > regex *r, int len) > > > > static int regex_match_end(char *str, struct regex *r, int len) > > { > > - int strlen = len - 1; > > + int slen = len ? strnlen(str, len) : strlen(str); > > [Severity: High] > Can calling strlen(str) when len == 0 cause an out-of-bounds read past the > end of the trace event record?
Ah, good catch! Indeed. len == 0 means it is 0. Ok, let's fix it. (maybe we should also reject len < 0 for safety?) Thanks, -- Masami Hiramatsu (Google) <[email protected]>
