Re: [PATCH 1/4] tracing/hist: Prevent overflow in histogram expression strings

[Steven Rostedt]

On Wed, 22 Jul 2026 14:10:37 +0800
Li Qiang <liqiang01@xxxxxxxxxx> wrote:

> expr_str() builds a histogram expression in a fixed-size
> MAX_FILTER_STR_VAL allocation with unbounded strcat() calls.
> Synthetic events permit field names longer than that buffer. Constructing
> a trigger expression can therefore write past the allocation.
> 
> Build the expression with seq_buf. Propagate construction errors to the
> parser and reject strings that overflow the fixed-size buffer with -E2BIG.
> 
> Fixes: 100719dcef44 ("tracing: Add simple expression support to hist triggers")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Li Qiang <liqiang01@xxxxxxxxxx>

This has been fixed by this:

   https://patch.msgid.link/20260611055945.22348-4-pengpeng@xxxxxxxxxxx

Since it can only be updated by root, I didn't not add a fixes nor a stable
tag and will be sending it in the next merge window (I haven't updated my
linux-next branch, but will soon)

-- Steve