[PATCH 4.14 29/62] tracing: Fix regex_match_front() to not over compare the test string

From: Greg Kroah-Hartman
Date: Mon May 14 2018 - 02:57:24 EST

4.14-stable review patch. If anyone has any objections, please let me know.


From: Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx>

commit dc432c3d7f9bceb3de6f5b44fb9c657c9810ed6d upstream.

The regex match function regex_match_front() in the tracing filter logic,
was fixed to test just the pattern length from testing the entire test
string. That is, it went from strncmp(str, r->pattern, len) to
strcmp(str, r->pattern, r->len).

The issue is that str is not guaranteed to be nul terminated, and if r->len
is greater than the length of str, it can access more memory than is

The solution is to add a simple test if (len < r->len) return 0.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 285caad415f45 ("tracing/filters: Fix MATCH_FRONT_ONLY filter matching")
Signed-off-by: Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

kernel/trace/trace_events_filter.c | 3 +++
1 file changed, 3 insertions(+)

--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -338,6 +338,9 @@ static int regex_match_full(char *str, s

static int regex_match_front(char *str, struct regex *r, int len)
+ if (len < r->len)
+ return 0;
if (strncmp(str, r->pattern, r->len) == 0)
return 1;
return 0;