From nobody Sat Jul 25 02:43:17 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBF963DEFE7; Mon, 20 Jul 2026 10:12:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542349; cv=none; b=X3N0CPRPZEjkDq16I9MdpEHafYveolXsHdZwFFn9rYp9dKTrARmqOIsrMLwOrK+wmu2miKG1j9ebNKwq7xliUpW+ySsN0Ha7PkTYjD+CPSMuWwJDjNMY0QYGCT1jVFFZRiwUXrqVFLoHIb5z7d08GXE5O6KNO9xlZUMpAJjWr3M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542349; c=relaxed/simple; bh=nW1XWdnCO2/couf4O46tAqF5rrEEQ3N4ykGS5f5lubw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mctbGpep1VW4Y5SDMRBU2lIPd/xgw3KiWkZkwSHijkTs41InyKTTfLjla0nsC1knQTSXM7zca+mr3OizsuXjy5+xTdanXnc6jLYuhWLv9rvE/oAnJDDbUki/Y1LWTeffjClDE6EJUAjOM4pdbMVtTWARcdVVEA6NkUqFp9RPQGQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=WDP8MkhQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="WDP8MkhQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E53601F00A3A; Mon, 20 Jul 2026 10:12:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784542334; bh=YxV8jmxvGTn0ml/JttIpiyp/M5Pb/0W7C9FqCS1HgJg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=WDP8MkhQagpBIZQK7vUKYt5uebHK+jlhFR7ZQHGbats8m3XbS7Igc97RJ82L3Qcc2 I7LSt2uj27nBRJD0KYO7RIeHdp8CKMg2HkUYW5WGkmoOfjl+VIsiTgRkzIIrUq69p8 0CjB6H9gCAG7WM5oSwa0sc55wubpkE7LqraAg00L+QdaQVa6u2tpW6ly/UwmyzAze6 HZ/Ik583+Xb2gTiFdtBqWCVX9DnJsK6I0Hmyr5pvtq/tTliH88+SXVj/hyuH8ORHED 6jEZvgZ2GJJFIaopEyxS+WBsvpIwf8Tvp9/EJvdYStD72wqPUpprfq5OgHHqkhrH9q Mik56rLRj8LTQ== From: "Masami Hiramatsu (Google)" To: Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers Cc: linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org Subject: [PATCH 1/4] tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() Date: Mon, 20 Jul 2026 19:12:10 +0900 Message-ID: <178454233010.290363.10428767141343428804.stgit@devnote2> X-Mailer: git-send-email 2.43.0 In-Reply-To: <178454232006.290363.11301475407231432622.stgit@devnote2> References: <178454232006.290363.11301475407231432622.stgit@devnote2> User-Agent: StGit/0.19 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Masami Hiramatsu (Google) In trace_probe_match_command_args(), a stack buffer buf[MAX_ARGSTR_LEN + 1] (256 bytes) is used to format "=3D". However, since name can be up to 32 bytes (MAX_ARG_NAME_LEN) and comm up to 255 bytes (MAX_ARGSTR_LEN), the formatted string can exceed 256 bytes and get truncated by snprintf(), causing spurious argument matching failures. Instead of formatting into a temporary buffer on stack, compare the argument name, the '=3D' delimiter, and the comm expression directly. Fixes: eb5bf81330a7 ("tracing/kprobe: Add per-probe delete from event") Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) --- kernel/trace/trace_probe.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index d17cfee77d9c..95e3d072321f 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -2338,16 +2338,17 @@ int trace_probe_compare_arg_type(struct trace_probe= *a, struct trace_probe *b) bool trace_probe_match_command_args(struct trace_probe *tp, int argc, const char **argv) { - char buf[MAX_ARGSTR_LEN + 1]; int i; =20 if (tp->nr_args < argc) return false; =20 for (i =3D 0; i < argc; i++) { - snprintf(buf, sizeof(buf), "%s=3D%s", - tp->args[i].name, tp->args[i].comm); - if (strcmp(buf, argv[i])) + int len =3D strlen(tp->args[i].name); + + if (strncmp(argv[i], tp->args[i].name, len) || + argv[i][len] !=3D '=3D' || + strcmp(argv[i] + len + 1, tp->args[i].comm)) return false; } return true; From nobody Sat Jul 25 02:43:17 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 28BFC3DDDC9; Mon, 20 Jul 2026 10:12:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542354; cv=none; b=fiXdhySEVkuYZVmrhx7j7AsQQ+S2834tBOwrZjw3eeKsqWnhZW2oV/OmsS+l0ucck8muXRRo0wJmzKuxdEForRDyB8c5AuLgWSoOY2an1WNAgisMEysXQxRMCT14FnAHcAHx2rm/+MhDUt7I4qjBElezjM95WClPKEWjdNy4ZQA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542354; c=relaxed/simple; bh=1AiS9B+t3qU+1/uIBx8ML7kKAI4vz2trbk6Bz2BK+uI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=lKtCqrU49SDZ/ITKLYPFlMbz90rj0j8Z3VZIa5qIBOhvHddtkPJMjGsoLZttvM+973c51XZCQOTU0/qf8hl6xKp1D54kwAD1SVED5oRruLbX/MEdosVXk47xh3pC8Wp9Dc2g6k8Nbimhk93NJrhZ9dODHfxcIPBN2dCOorS7HKE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FH4kRi7q; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FH4kRi7q" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70CDB1F000E9; Mon, 20 Jul 2026 10:12:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784542343; bh=TRnSNdJJ5HxRVmdzYJIAGXiOj/310Q87mPBJ3yN1MPU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FH4kRi7qvbGz5uNvtIRi075P0Ljva+2OUaQLhzkuahzJMXinEV0H+brE/QiMITv2T woMk+MV93tmQoev4lfkC2tvC5QDypLT8Gmc7Z/NM4BL3YcOI8I4T2cmEwpDz2gIldf 3vyy9ilIKKatCRMi5EqljS48eNqKP01A7KWn+HNexgiuZnwdIKEGC7YPk+abOV0PgX IVx6B6OK39t/aP2ZkyQlhb3sreTQAw8si03GjgVbzl1xOXn9C1NRh5k+8hAaWOwvTA SrnZJmIsmKRDzrz/yZk9PR+kx1zny9GxQUrECzOuHIIOianzhJ86a04AqxZU+IjNAT Rfh1glfZiGIqg== From: "Masami Hiramatsu (Google)" To: Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers Cc: linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org Subject: [PATCH 2/4] tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Date: Mon, 20 Jul 2026 19:12:20 +0900 Message-ID: <178454233992.290363.18323091580600697731.stgit@devnote2> X-Mailer: git-send-email 2.43.0 In-Reply-To: <178454232006.290363.11301475407231432622.stgit@devnote2> References: <178454232006.290363.11301475407231432622.stgit@devnote2> User-Agent: StGit/0.19 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Masami Hiramatsu (Google) If trace_probe_log.argc is 0 in __trace_probe_log_err(), the loop constructing the command string will not execute and p will remain equal to command. Writing to *(p - 1) will cause an out-of-bounds access before command. This should not happen, but better to be treated. Reject if trace_probe_log.argc is 0. Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events") Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) --- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 95e3d072321f..49daa3cc2a45 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -188,7 +188,7 @@ void __trace_probe_log_err(int offset, int err_type) =20 lockdep_assert_held(&dyn_event_ops_mutex); =20 - if (!trace_probe_log.argv) + if (!trace_probe_log.argv || !trace_probe_log.argc) return; =20 /* Recalculate the length and allocate buffer */ From nobody Sat Jul 25 02:43:17 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D54263E0749; Mon, 20 Jul 2026 10:12:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542369; cv=none; b=hsfBHCCVgDc/Id8y5cA0Wr05Mq/6C6xl1eDh+8zeyQdP6qeKUMtAfv2Uhi2Pbtw/eTHFER2hBHNR5n0Z4n/k/wAMLrubTcBhDnEDzGDcPHhKnhS3e6GFRCeNE4JIYsSyAKr7Eo8nlpvXishWUq7YEqkyYGAV03/7TmoSVoQYgHg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542369; c=relaxed/simple; bh=wDNlZX4N0mTjaVYhKlMTx430kPWvfP4V810QBypJb5w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Xfv+VHaX+5v1FGF6Q701gr45KmrAYu+m0pRgF1o6ECQzbpCGdTocwfkrutT+3aFzRoGb9u7KCNUeTZYhURMROPxb8vhEBsFy/9UMNhcG6YWKxz40uKms3l0OB2ZJCa02Ps0mbkX5+aiUTltknl25vaKxMBytV/maW/jU4QpvbAM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=jGOrxmMy; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="jGOrxmMy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BED891F00A3A; Mon, 20 Jul 2026 10:12:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784542353; bh=PJy2QJ5d4MMnuzXMiWK9VOTWPQHlURmP4d7ABbZpQ74=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jGOrxmMyM3YTX2Yit9aVnqcgTkbiyeZ5qDP0hX7JrostQVAKDyW14bEkQs1b7Dwwi 8ukob3pbUEF3cKwK7dLPCzu2u78Xoi0J348ZfOlUI9/hLzwQE3eLmxYF+6Sn72tn/d FfIHzDKHdCy3skXBOf5U+35dTCKylzeVHOZ+erXN4fEpsJtKFjl2trguUQHPYcFGpY 0PUfU7J0ZM4nQ05BL3RpXutsQK14kUQW42OB3AGQttU3edTzXpCyZ2ujr0t1cGawYP ejTJBWIaEDcuJmt0Sdq0yVbsaEa01+6RuRXrDeP3KyM9LJDSKur/OjsOQw8sC/QO3p gioX0ywv7HlIQ== From: "Masami Hiramatsu (Google)" To: Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers Cc: linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org Subject: [PATCH 3/4] tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Date: Mon, 20 Jul 2026 19:12:29 +0900 Message-ID: <178454234934.290363.15247317871499514139.stgit@devnote2> X-Mailer: git-send-email 2.43.0 In-Reply-To: <178454232006.290363.11301475407231432622.stgit@devnote2> References: <178454232006.290363.11301475407231432622.stgit@devnote2> User-Agent: StGit/0.19 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Masami Hiramatsu (Google) In __set_print_fmt(), LEN_OR_ZERO is defined as (len ? len - pos : 0). If len is non-zero but smaller than pos, len - pos evaluates to a negative integer. When passed as a size argument to snprintf(), this negative value is cast to a large unsigned size_t, bypassing buffer size limits. Ensure len > pos before subtracting to avoid integer underflow. Fixes: 5bf652aaf46c ("tracing/probes: Integrate duplicate set_print_fmt()") Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) --- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 49daa3cc2a45..506e6037e163 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -2013,7 +2013,7 @@ int traceprobe_update_arg(struct probe_arg *arg) } =20 /* When len=3D0, we just calculate the needed length */ -#define LEN_OR_ZERO (len ? len - pos : 0) +#define LEN_OR_ZERO (len > pos ? len - pos : 0) static int __set_print_fmt(struct trace_probe *tp, char *buf, int len, enum probe_print_type ptype) { From nobody Sat Jul 25 02:43:17 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27D5D3DB97A; Mon, 20 Jul 2026 10:12:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542372; cv=none; b=gZjzGoZATdQATgi+Afvv1liV5wuiRSAJwRMHDAjSby4i4331dlyd57o+Plpp6oMOhtZUtMxH4i1Xo9R0R0LwtIrDyZ6SmTbuImPkL7bt20kl5oWtFoW6WGEWrlLY521rQrE9v7hejvY2fYVINmFIm1VtuSXZP5FgiVRc2oXWtIs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542372; c=relaxed/simple; bh=Pq9Aj2PpjMdyraoMOlDwZjHrqvrQlJ5+jJWqtZcvKo8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Uxor6rYC94g/2/t3intSSqWbMLgmky0DNP22PekuXCn6iosJHrf0/aNLqUb7iH+TP1K30He/lcjMFhYZu1gzz+jjkKR7DuSbu5rLbJ8yfP/PfOaYvPGcNGVhkfZMaV4fAND8OiNuSaBrf9Td2BVzdUk2pxODTlDrYSfWT/PZae8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Y4s0tY9C; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Y4s0tY9C" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA3011F000E9; Mon, 20 Jul 2026 10:12:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784542362; bh=Wj6Eht4nV+LXDmswAnUY/xG6xO9bB65RpQzx+KrkowI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Y4s0tY9Crx6M5T5mC3+8z/WeARVA0oist9bWt48uMysQ66Ws1dEgE3yolJgaQ9Sbq RmkjbcpGmWDvDjZa/tHhS6khOjQdQxhBWsUwooXFZ+jTPD80e6KamdnWaHAnp6KtU5 9BlJ7tXkzrv1YCyl660lPPx8+QHqBJtF/AVs4RaYwYEe03/5tLuYnkQ8VvHCIhWloJ 4OPA6QINZn89K0Ja3UahbXPHsvubtXlrKyn3fokvhJ3XeRWLCnoy1JWF4DdcCAsiTe pG3qfnYqd687CeBxGVOFuA4oGPbWUTmbMuUVXsrDTg3fIzIyFMt9qR34P0OYpH8Jvt WoM6Lp/WAlsGg== From: "Masami Hiramatsu (Google)" To: Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers Cc: linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org Subject: [PATCH 4/4] tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() Date: Mon, 20 Jul 2026 19:12:38 +0900 Message-ID: <178454235856.290363.14872590900774231133.stgit@devnote2> X-Mailer: git-send-email 2.43.0 In-Reply-To: <178454232006.290363.11301475407231432622.stgit@devnote2> References: <178454232006.290363.11301475407231432622.stgit@devnote2> User-Agent: StGit/0.19 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Masami Hiramatsu (Google) eprobe_dyn_event_match() checks if the target event system in argv[0] matches ep->event_system using strncmp(ep->event_system, argv[0], len). However, if ep->event_system is longer than len (e.g. "eprobes" vs "ep/event"), strncmp() still returns 0 because the first len characters match. Check that ep->event_system[len] is '\0' to ensure exact system name matching. Fixes: 7d5fda1c841f ("tracing: Fix event probe removal from dynamic events") Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) --- kernel/trace/trace_eprobe.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c index 50518b071414..bcd97cb24ac9 100644 --- a/kernel/trace/trace_eprobe.c +++ b/kernel/trace/trace_eprobe.c @@ -172,7 +172,8 @@ static bool eprobe_dyn_event_match(const char *system, = const char *event, if (!slash) return false; =20 - if (strncmp(ep->event_system, argv[0], slash - argv[0])) + if (strncmp(ep->event_system, argv[0], slash - argv[0]) || + ep->event_system[slash - argv[0]] !=3D '\0') return false; if (strcmp(ep->event_name, slash + 1)) return false;