Commit 5ec1d1e9 authored by Pengpeng Hou's avatar Pengpeng Hou Committed by Steven Rostedt (Google)
Browse files

tracing: Rebuild full_name on each hist_field_name() call 

hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully
qualified variable-reference names, but it currently appends into that
buffer with strcat() without rebuilding it first. As a result, repeated
calls append a new "system.event.field" name onto the previous one,
which can eventually run past the end of full_name.

Build the name with snprintf() on each call and return NULL if the fully
qualified name does not fit in MAX_FILTER_STR_VAL.

Link: https://patch.msgid.link/20260401112224.85582-1-pengpeng@iscas.ac.cn


Fixes: 067fe038 ("tracing: Add variable reference handling to hist triggers")
Reviewed-by: default avatarTom Zanussi <zanussi@kernel.org>
Tested-by: default avatarTom Zanussi <zanussi@kernel.org>
Signed-off-by: default avatarPengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent 0ec6be95

kernel/trace/trace_events_hist.c

+7 −5
Original line number Diff line number Diff line
@@ -1361,12 +1361,14 @@ static const char *hist_field_name(struct hist_field *field, 
		 field->flags & HIST_FIELD_FL_VAR_REF) {

		if (field->system) {

			static char full_name[MAX_FILTER_STR_VAL];

			int len;



			len = snprintf(full_name, sizeof(full_name), "%s.%s.%s",

				       field->system, field->event_name,

				       field->name);

			if (len >= sizeof(full_name))

				return NULL;



			strcat(full_name, field->system);

			strcat(full_name, ".");

			strcat(full_name, field->event_name);

			strcat(full_name, ".");

			strcat(full_name, field->name);

			field_name = full_name;

		} else

			field_name = field->name;