From: Masami Hiramatsu (Google) Date: Mon, 20 Jul 2026 10:12:20 +0000 (+0900) Subject: tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a9d6fb284039a5d3858a1d9f9a0d7e46cfb7c2d4;p=thirdparty%2Fkernel%2Flinux.git tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() If trace_probe_log.argc is 0 in __trace_probe_log_err(), the loop constructing the command string will not execute and p will remain equal to command. Writing to *(p - 1) will cause an out-of-bounds access before command. This should not happen, but better to be treated. Reject if trace_probe_log.argc is 0. Link: https://lore.kernel.org/all/178454233992.290363.18323091580600697731.stgit@devnote2/ Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events") Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) --- diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 95e3d072321f..49daa3cc2a45 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -188,7 +188,7 @@ void __trace_probe_log_err(int offset, int err_type) lockdep_assert_held(&dyn_event_ops_mutex); - if (!trace_probe_log.argv) + if (!trace_probe_log.argv || !trace_probe_log.argc) return; /* Recalculate the length and allocate buffer */