kernel/git/next/linux-next.git/lib/glob.c, branch master

tracing: Prevent out-of-bounds read in glob matching

2026-07-07T14:42:28+00:00

String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it. regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint. Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour. Fixes: 60f1d5e3bac4 ("ftrace: Support full glob matching") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/da1aaf125fc3b63320b0c540fd6afa7c3d5b4f1a.1782836943.git.hhhuang@smu.edu.sg Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Zhengchuan Liang Reported-by: Xin Liu Assisted-by: Codex:GPT-5.4 Signed-off-by: Huihui Huang Signed-off-by: Ren Wei Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt

lib/glob: initialize back_str to silence uninitialized variable warning

2026-03-28T04:19:45+00:00

back_str is only used when back_pat is non-NULL, and both are always set together, so it is safe in practice. Initialize back_str to NULL to make this safety invariant explicit and silence compiler/static analysis warnings. Link: https://lkml.kernel.org/r/20260312215249.50165-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton

lib/glob: clean up "bool abuse" in pointer arithmetic

2026-03-28T04:19:38+00:00

Replace the implicit 'bool' to 'int' conversion with an explicit ternary operator. This makes the pointer arithmetic clearer and avoids relying on boolean memory representation for logic flow. Link: https://lkml.kernel.org/r/20260301203845.2617217-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton

lib: glob: replace bitwise OR with logical operation on boolean

2026-03-28T04:19:37+00:00

Using bitwise OR (|=) on a boolean variable is valid C, but replacing it with a direct logical assignment makes the intent clearer and appeases strict static analysis tools. Link: https://lkml.kernel.org/r/20260301152143.2572137-2-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton

lib: glob: add explicit include for export.h

2026-03-28T04:19:37+00:00

Include explicitly instead of relying on it being implicitly included by for the EXPORT_SYMBOL macro. Link: https://lkml.kernel.org/r/20260301152143.2572137-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton

lib: glob: fix grammar and replace non-inclusive terminology

2026-03-28T04:19:37+00:00

Fix a missing article ('a') in the comment describing the glob implementation, and replace 'blacklists' with 'denylists' to align with the kernel's inclusive terminology guidelines. Link: https://lkml.kernel.org/r/20260301154553.2592681-1-objecting@objecting.org Signed-off-by: Josh Law Signed-off-by: Andrew Morton

lib: glob: add missing SPDX-License-Identifier

2026-03-28T04:19:36+00:00

Add the missing dual MIT/GPL license identifier to glob.c. Link: https://lkml.kernel.org/r/20260228195300.2468310-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton

lib: glob.c: added null check for character class

2024-09-09T23:47:41+00:00

Add null check for character class. Previously, an inverted character class could result in a nul byte being matched and lead to the function reading past the end of the inputted string. Link: https://lkml.kernel.org/r/20240826155709.12383-1-swaminathanalok@gmail.com Signed-off-by: Alok Swaminathan Signed-off-by: Andrew Morton

lib: remove back_str initialization

2022-04-29T21:38:01+00:00

Clang static analysis reports this false positive glob.c:48:32: warning: Assigned value is garbage or undefined char const *back_pat = NULL, *back_str = back_str; ^~~~~~~~ ~~~~~~~~ back_str is set after back_pat and it's use is protected by the !back_pat check. It is not necessary to initialize back_str, so remove the initialization. Link: https://lkml.kernel.org/r/20220402131546.3383578-1-trix@redhat.com Signed-off-by: Tom Rix Reviewed-by: Nick Desaulniers Cc: Nathan Chancellor Signed-off-by: Andrew Morton

Revert "lib: Revert use of fallthrough pseudo-keyword in lib/"

2020-11-18T20:15:17+00:00

This reverts commit 6a9dc5fd6170 ("lib: Revert use of fallthrough pseudo-keyword in lib/") Now that we can build arch/powerpc/boot/ free of -Wimplicit-fallthrough, re-enable these fixes for lib/. Signed-off-by: Nick Desaulniers Tested-by: Nathan Chancellor Reviewed-by: Nathan Chancellor Reviewed-by: Gustavo A. R. Silva Reviewed-by: Miguel Ojeda Link: https://github.com/ClangBuiltLinux/linux/issues/236 Signed-off-by: Gustavo A. R. Silva