tracing/probes: Reject $arg0 in meta argument expansion

traceprobe_expand_meta_args() parses $argN with simple_strtoul() and
calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is
-1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in
sprint_nth_btf_arg() does not catch the negative index, and
ctx->params[-1].name_off is read out of bounds.

The normal per-argument path (parse_probe_vars()) already rejects
$arg0 via its argument-number check, but meta-argument expansion runs
before per-argument parsing and substitutes the value first, bypassing
that check.

Reject $arg0 explicitly during expansion.

Link: https://lore.kernel.org/all/20260724054435.146279-1-raushan.jhon@gmail.com/
Fixes: 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args")
Cc: stable@vger.kernel.org
Signed-off-by: Raushan Patel <raushan.jhon@gmail.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index 506e6037e16375fb3de1bc4ea28bbdf803e9d1ef..c8fd9b946f442e3f0b4a9862c9db623d4a390d13 100644 (file)
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -1901,7 +1901,11 @@ const char **traceprobe_expand_meta_args(int argc, const char *argv[],
                                trace_probe_log_err(0, BAD_VAR);
                                return ERR_PTR(-ENOENT);
                        }
-                       /* Note: $argN starts from $arg1 */
+                       /* Note: $argN starts from $arg1, so $arg0 is invalid. */
+                       if (n == 0) {
+                               trace_probe_log_err(0, BAD_ARG_NUM);
+                               return ERR_PTR(-EINVAL);
+                       }
                        ret = sprint_nth_btf_arg(n - 1, type, buf + used,
                                                 bufsize - used, ctx);
                        if (ret < 0)