diff options
| author | Masami Hiramatsu (Google) <mhiramat@kernel.org> | 2026-07-20 19:12:20 +0900 |
|---|---|---|
| committer | Masami Hiramatsu (Google) <mhiramat@kernel.org> | 2026-07-21 10:23:13 +0900 |
| commit | a9d6fb284039a5d3858a1d9f9a0d7e46cfb7c2d4 (patch) | |
| tree | dd178b27cdfef3442f5e91ddfcaa0f6868cab0e8 /kernel | |
| parent | 15f197856d68882af9416fc97516bb55079b7677 (diff) | |
| download | linux-a9d6fb284039a5d3858a1d9f9a0d7e46cfb7c2d4.tar.gz linux-a9d6fb284039a5d3858a1d9f9a0d7e46cfb7c2d4.tar.bz2 linux-a9d6fb284039a5d3858a1d9f9a0d7e46cfb7c2d4.zip | |
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
If trace_probe_log.argc is 0 in __trace_probe_log_err(), the loop
constructing the command string will not execute and p will remain equal to
command. Writing to *(p - 1) will cause an out-of-bounds access before
command. This should not happen, but better to be treated.
Reject if trace_probe_log.argc is 0.
Link: https://lore.kernel.org/all/178454233992.290363.18323091580600697731.stgit@devnote2/
Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events")
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/trace/trace_probe.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 95e3d072321f..49daa3cc2a45 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -188,7 +188,7 @@ void __trace_probe_log_err(int offset, int err_type) lockdep_assert_held(&dyn_event_ops_mutex); - if (!trace_probe_log.argv) + if (!trace_probe_log.argv || !trace_probe_log.argc) return; /* Recalculate the length and allocate buffer */ |