On Wed, 22 Jul 2026 14:10:37 +0800
Li Qiang <[email protected]> wrote:
> expr_str() builds a histogram expression in a fixed-size
> MAX_FILTER_STR_VAL allocation with unbounded strcat() calls.
> Synthetic events permit field names longer than that buffer. Constructing
> a trigger expression can therefore write past the allocation.
>
> Build the expression with seq_buf. Propagate construction errors to the
> parser and reject strings that overflow the fixed-size buffer with -E2BIG.
>
> Fixes: 100719dcef44 ("tracing: Add simple expression support to hist
> triggers")
> Cc: [email protected]
> Signed-off-by: Li Qiang <[email protected]>
This has been fixed by this:
https://patch.msgid.link/[email protected]
Since it can only be updated by root, I didn't not add a fixes nor a stable
tag and will be sending it in the next merge window (I haven't updated my
linux-next branch, but will soon)
-- Steve
