From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f172.google.com (mail-oi1-f172.google.com [209.85.167.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C0973BB115 for ; Tue, 6 Oct 2026 22:56:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791327410; cv=none; b=TLdUvRhYOxdSvTdY+EzrKH1K6Kyy93YgQ95qo/Y/2ejJ6V2BYtD1xkChp15gb1hjVjJs+XQJKKKAVZxbD4MA1BJNkexa9IbEspRjCvEmvuoGRdWQJYF5hE9BDWhkzInzjpgTkQPF5ONy5D47MgDk5X9wTHnVkxwI/DQrK/Ah4BQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791327410; c=relaxed/simple; bh=MzJid57T7kvVDqpjL+7+fiHFXPk+H9FgHow2luDCwDU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ISIzrpMVDzGNP7S1hRGUkILMCJoyuqz77bNttJ8O+f8PXhTXGu9zzOE1ElFQRmovbsuf5b6gCL7qeYgp091D2JVfcLHzm4Vvrrtw1GtxYfsnINC3YXq4FLoQSUVm0Ie9CaH/p+zcMKdvf7pb1yhdIIgLbwOq+QJXgJnRiXSGBY0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=openai.com; spf=pass smtp.mailfrom=openai.com; dkim=pass (1024-bit key) header.d=openai.com header.i=@openai.com header.b=Ncjx6BPp; arc=none smtp.client-ip=209.85.167.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=openai.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openai.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=openai.com header.i=@openai.com header.b="Ncjx6BPp" Received: by mail-oi1-f172.google.com with SMTP id 5614622812f47-495c49f8eccso2194002b6e.3 for ; Tue, 06 Oct 2026 15:56:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openai.com; s=google; t=1791327409; x=1791932209; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=9OqI0lB2VAAehqC+cvR7VBFVsvBHKaFqIk6BYnoJbq0=; b=Ncjx6BPpcFCsCiN4HUaHVN9lrDTLmA9v7Fdv466s+ugJ6hVKNU8pOEFYCaE5CD2JDZ fZLujPXZIVRWemw9LaAw00iKSb3MyqTqcMacLNV+PkpCqWiugd3pCsRfVw2o0DX7sf7a 92OY8mW9fFo3gKuL3gw5e9o//4e4hyyPclOtA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791327409; x=1791932209; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9OqI0lB2VAAehqC+cvR7VBFVsvBHKaFqIk6BYnoJbq0=; b=aZLKP9mt67hM7Q4o8zw49ezvrQ7SWkVLbAw0/RC7pqBQuYQHtYDXOFqNfDGrsh2oTV cd+oM7cJXTekvCWGaoa94elaIANEfVf0pL9BIO//D5w4QWvGuK+RfYhrp84j9lD9DNd6 h/DHbWTsy6fWprEQY0fRPtLSk74nzgUb1rUWd6kWk2qSKTha4iu1YQTEQ8NRwyP7Tmsx tBTfcN/5fkFVA7ceT4QPAp7Ht5VOcWdLTf9QSxm6+iQrvKGNprHLmwVTLEw8hpcRupyh f8zAmpWXgnqAqMi8yOrQJdZQ/BIra8QyQkcidtd68Litas+sla/QJSxJoQvMbOh4IPtk s89g== X-Gm-Message-State: AFuF++lsmhfrIw7S9wZ0g4WCr9z/fp41h7OK0hjo9I2KryrZkH7iyf/d 0hsCqnGRIQfdSmy75SDEDthf4FfaQR9RCkDp/UE3vFJsDsFv7aWTTNv5HOo6eAANO0I= X-Gm-Gg: AYBFou1ue2yWhu0JSFUq1XdAOpIHVWYir3ZlVv9T0Uf9MYSyqlMSBvvWqCm0mDIv0ju HWfR9P5YSNZQMU2orx4icIeYI8rMr1WGQjHbsjN2LfM7bMarUZMWqhjlmhgk4t/uqiXY9sgrKU1 BIa3RLB/DzvHdXBhsfUMibRChtaI0d325RUFiFuPIxFVmqpxkPNBmxQMaqWXrhL8KA96eDj06bo hj2CnYbtlz+1Mg5XUkRr5yRHfcCv+xWTN3ST8+kbiNea6TKIFT036Kx4ZS56gIeiG3zSOc7lY+q e1XSsTq+k7R8n4k1YM45tYCaGZKFDX5d4vmUTUwLk610dmggx0+V2n74+6Ac/Xep0tGel3CBjKp mGXGx3kLY0qotwCYqgDkxKEUpY/ArMb9K0C3eeh58UHSB4yVFzcO0/vKmbrHDE53y4eVE5FWtcm eQsJavzRrCLbI3BrDamdEMTL64IXrXWtZIrbGXXJ7aHtMTKLoTGLS9QsNffnBenYkXFS2pugWBj GvQQq55apn13YQQvVYrfFIi1/46jiWHMtGVdtJnP8Bd+YsKskML/uS6bhJvkH6wOyusbegE/ek= X-Received: by 2002:a05:6808:5094:b0:4fb:90ae:2b02 with SMTP id 5614622812f47-4fc4626c663mr837917b6e.52.1791327409290; Tue, 06 Oct 2026 15:56:49 -0700 (PDT) Received: from com-75606.corp.openai.org ([199.47.143.7]) by smtp.gmail.com with ESMTPSA id 5614622812f47-4fc48b0cb3csm671474b6e.7.2026.10.06.15.56.48 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 06 Oct 2026 15:56:48 -0700 (PDT) From: Kyle Zeng To: linux-trace-kernel@vger.kernel.org Cc: linux-kernel@vger.kernel.org, rostedt@goodmis.org, mhiramat@kernel.org, outbounddisclosures@openai.com, Kyle Zeng , stable@vger.kernel.org Subject: [PATCH] tracing/filters: Treat zero-length dynamic strings as empty Date: Tue, 6 Oct 2026 15:56:42 -0700 Message-ID: <20261006225642.58778-1-kylebot@openai.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The regex callbacks use a length of zero for NUL-terminated strings of unknown size, such as the trailing buffer in a trace_marker record. However, filter_pred_strloc() and filter_pred_strrelloc() pass the length from a data locator directly to those callbacks. A zero-length locator has no data and need not point at a NUL byte. In particular, syscall entry events can contain an empty captured array or a failed user-string copy. Matching such a field with an equality, prefix, or substring filter can read beyond the record. The per-CPU perf trace buffer is reused, so an unprivileged counting syscall event can disclose bytes left by a previous kernel tracepoint even when raw sampling is denied and exclude_kernel prevents counting that tracepoint. Handle both locator formats through a common helper. For a zero-length field, pass an empty string and its actual size to the regex callback. This gives all matching modes the empty-string semantics without reading the locator's target. Keep nonzero fields and the legacy trace_marker unknown-length convention unchanged. Fixes: 10f20e9f9da9 ("tracing: Have zero size length in filter logic be full string") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-6-astra Signed-off-by: Kyle Zeng --- kernel/trace/trace_events_filter.c | 38 +++++++++++++++++++----------- 1 file changed, 24 insertions(+), 14 deletions(-) diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c index 2b46ca536045..02aaa92e0361 100644 --- a/kernel/trace/trace_events_filter.c +++ b/kernel/trace/trace_events_filter.c @@ -884,6 +884,25 @@ static int filter_pred_pchar_user(struct filter_pred *pred, void *event) return filter_pchar(pred, str); } +static __always_inline int filter_dyn_string(struct filter_pred *pred, + char *str, int len) +{ + int cmp; + + /* + * The regex callbacks use zero for an unknown-length, NUL-terminated + * string. A zero-length data_loc or rel_loc field has no bytes at all. + * Match an empty string instead of reading past the end of the field. + */ + if (!len) { + str = ""; + len = 1; + } + + cmp = pred->regex->match(str, pred->regex, len); + return cmp ^ pred->not; +} + /* * Filter predicate for dynamic sized arrays of characters. * These are implemented through a list of strings at the end @@ -900,13 +919,8 @@ static int filter_pred_strloc(struct filter_pred *pred, void *event) int str_loc = str_item & 0xffff; int str_len = str_item >> 16; char *addr = (char *)(event + str_loc); - int cmp, match; - - cmp = pred->regex->match(addr, pred->regex, str_len); - match = cmp ^ pred->not; - - return match; + return filter_dyn_string(pred, addr, str_len); } /* @@ -923,13 +937,8 @@ static int filter_pred_strrelloc(struct filter_pred *pred, void *event) int str_loc = str_item & 0xffff; int str_len = str_item >> 16; char *addr = (char *)(&item[1]) + str_loc; - int cmp, match; - - cmp = pred->regex->match(addr, pred->regex, str_len); - match = cmp ^ pred->not; - - return match; + return filter_dyn_string(pred, addr, str_len); } /* Filter predicate for CPUs. */ @@ -1014,7 +1023,8 @@ static int filter_pred_function(struct filter_pred *pred, void *event) * * @str: the string to be searched * @r: the regex structure containing the pattern string - * @len: the length of the string to be searched (including '\0') + * @len: the length of the string to be searched (including '\0'), or zero + * for a NUL-terminated string of unknown length * * Note: * - @str might not be NULL-terminated if it's of type DYN_STRING @@ -1023,7 +1033,7 @@ static int filter_pred_function(struct filter_pred *pred, void *event) static int regex_match_full(char *str, struct regex *r, int len) { - /* len of zero means str is dynamic and ends with '\0' */ + /* Zero is reserved for a NUL-terminated string of unknown length. */ if (!len) return strcmp(str, r->pattern) == 0;