Patch "tracing/histogram: Do not copy the fixed-size char array field over the field size" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tracing/histogram: Do not copy the fixed-size char array field over the field size

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tracing-histogram-do-not-copy-the-fixed-size-char-ar.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 12ef293e7ba0ec193e886b6d888e6fba4c991dbe
Author: Masami Hiramatsu <mhiramat@xxxxxxxxxx>
Date:   Sat Nov 13 01:02:08 2021 +0900

    tracing/histogram: Do not copy the fixed-size char array field over the field size
    
    [ Upstream commit 63f84ae6b82bb4dff672f76f30c6fd7b9d3766bc ]
    
    Do not copy the fixed-size char array field of the events over
    the field size. The histogram treats char array as a string and
    there are 2 types of char array in the event, fixed-size and
    dynamic string. The dynamic string (__data_loc) field must be
    null terminated, but the fixed-size char array field may not
    be null terminated (not a string, but just a data).
    In that case, histogram can copy the data after the field.
    This uses the original field size for fixed-size char array
    field to restrict the histogram not to access over the original
    field size.
    
    Link: https://lkml.kernel.org/r/163673292822.195747.3696966210526410250.stgit@devnote2
    
    Fixes: 02205a6752f2 (tracing: Add support for 'field variables')
    Signed-off-by: Masami Hiramatsu <mhiramat@xxxxxxxxxx>
    Signed-off-by: Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 9a73c187d241e..8b33a3c872750 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -2590,9 +2590,10 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data,
 		if (!hist_field->type)
 			goto free;
 
-		if (field->filter_type == FILTER_STATIC_STRING)
+		if (field->filter_type == FILTER_STATIC_STRING) {
 			hist_field->fn = hist_field_string;
-		else if (field->filter_type == FILTER_DYN_STRING)
+			hist_field->size = field->size;
+		} else if (field->filter_type == FILTER_DYN_STRING)
 			hist_field->fn = hist_field_dynstring;
 		else
 			hist_field->fn = hist_field_pstring;
@@ -3530,7 +3531,7 @@ static inline void __update_field_vars(struct tracing_map_elt *elt,
 			char *str = elt_data->field_var_str[j++];
 			char *val_str = (char *)(uintptr_t)var_val;
 
-			strscpy(str, val_str, STR_VAR_LEN_MAX);
+			strscpy(str, val_str, val->size);
 			var_val = (u64)(uintptr_t)str;
 		}
 		tracing_map_set_var(elt, var_idx, var_val);
@@ -5359,7 +5360,7 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data,
 
 				str = elt_data->field_var_str[idx];
 				val_str = (char *)(uintptr_t)hist_val;
-				strscpy(str, val_str, STR_VAR_LEN_MAX);
+				strscpy(str, val_str, hist_field->size);
 
 				hist_val = (u64)(uintptr_t)str;
 			}