Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] tracing/filters: unhandled zero len in regex_match_end_str() --
commit 92251abf42afdb93bef9298fec46088f078a4aa8 Author: Masami Hiramatsu (Google) <[email protected]> tracing/filters: Fix MATCH_END_ONLY regex matching for fixed-size strings This commit introduces regex_match_end_str() to handle suffix regex matching on fixed-size string buffers using strnlen(), and assigns it in parse_pred() for comm and static string fields. > diff --git a/kernel/trace/trace_events_filter.c > b/kernel/trace/trace_events_filter.c > index 59a0d3ba72740..f7c067a58ba41 100644 > --- a/kernel/trace/trace_events_filter.c > +++ b/kernel/trace/trace_events_filter.c > @@ -1087,6 +1087,20 @@ static int regex_match_end(char *str, struct regex *r, > int len) > return 0; > } > > +static int regex_match_end_str(char *str, struct regex *r, int len) > +{ > + int slen; > + > + if (len < r->len) > + return 0; > + > + slen = strnlen(str, len); > + if (slen >= r->len && > + memcmp(str + slen - r->len, r->pattern, r->len) == 0) > + return 1; > + return 0; > +} [Severity: Medium] How does regex_match_end_str() behave when len is 0? For the ftrace/print event, the buf field is defined in kernel/trace/trace_export.c with a size of 0: #undef __dynamic_array #define __dynamic_array(_type, _item) { \ .type = #_type "[]", .name = #_item, \ .size = 0, .align = __alignof__(_type), \ is_signed_type(_type), .filter_type = FILTER_OTHER }, Because its type is "char[]", filter_assign_type() classifies it as a static string field while field->size remains 0. In parse_pred(), pred->regex->field_len is set to field->size (0) and pred->regex->match is set to regex_match_end_str(): } else if (field->filter_type == FILTER_STATIC_STRING) { pred->fn_num = FILTER_PRED_FN_STRING; pred->regex->field_len = field->size; if (pred->regex->match == regex_match_end) pred->regex->match = regex_match_end_str; When a trigger or eprobe with a suffix filter (such as buf ~ "*foo") is evaluated via write_marker_to_buffer() -> event_triggers_call() -> filter_match_preds() -> filter_pred_string(), regex_match_end_str() is called with len == 0. As noted in the comment above regex_match_full() (added in commit 10f20e9f9da9 ("tracing: Have zero size length in filter logic be full string")), a len of zero indicates that str is a NUL-terminated string, which regex_match_full(), regex_match_front(), and regex_match_middle() handle explicitly: static int regex_match_full(char *str, struct regex *r, int len) { /* len of zero means str is dynamic and ends with '\0' */ if (!len) return strcmp(str, r->pattern) == 0; In regex_match_end_str(), however, when len is 0, the (len < r->len) check returns 0 for any non-empty pattern, and strnlen(str, 0) also returns 0. Should regex_match_end_str() check for !len and use strlen(str) in that case, so that suffix filters on ftrace/print work as expected? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/179314820431.684037.4147763044424284198.stgit@devnote2?part=2
