From nobody Sat Jul 25 01:24:12 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47C9D390CBF for ; Tue, 21 Jul 2026 08:57:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784624240; cv=none; b=EIKEYBNVe5Z8it4wjRwNaN9DukqL7JAAfLKq1Wnsfhed5+jNSW3geS3LRr+yDQWFoKCqkbd4o3rmNm8PtgHd3sUCYfPMj+lQ4DKWTeArY1GNEQ5ZVzJlfqNnOl++oE455U73ecyAOFPbS4kCchTqSjzUka/LXoK2UFNppq3qlM8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784624240; c=relaxed/simple; bh=O5j6Rtyp6LumkTUcweqdDOd/6jTli39zsG9yBeRMw0Q=; h=Date:From:To:Cc:Subject:Message-Id:Mime-Version:Content-Type; b=Bq/ztp4HJ6xfb3Y8cAp0rnLgxZiSvKPtvkl+YiGTNQsK3CySrrqjGsYZL54vvHjySRGDDs0Brenv7/IIU5/fOoU5MH1+4QrsaoVB1nmUKvUL4k+A8oF7wc1VIznK4N8lobEMHtIaBl8X7VwmLUpigMLVTl9gXoV0J4v+gpElb7w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=kmxe8SU2; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="kmxe8SU2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8CB9F1F000E9; Tue, 21 Jul 2026 08:57:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784624239; bh=B1+K0V27ksQKKPlRKCtuV/N1PEJnuxvBzfMAbA3A58k=; h=Date:From:To:Cc:Subject; b=kmxe8SU2Y16Vq5q+OYieHrcGtKmJ5OOAZqmcoiJUQE5aLg3D5PNZh6xSThJG8jIx1 LsO/5L0gZds8j5TPc7CGFDpLz3YC3cDvgfeydTGf4WWtt3BpLx/DkvQ8HhsDGOYSRx k/DXMFCIFoZFtPeWxxUIMSNLixm2N3+eSFjxxlbjvXwVVdOq7akAxPyULYLKKy2twG 9YAtQaxMCuM7XgarVJ3HbTHzL2EeknGBnAuOtXUqe0kopeQmI+/kIv+NNueqm69sLJ SeuFQRXQkCBg/tDKaIQaRaNmu2mT76dzV4w9Su7nRuR1F0CwIwhqXyXnKFQcmq/3yG ZUqDSFVOu9HIw== Date: Tue, 21 Jul 2026 17:57:15 +0900 From: Masami Hiramatsu (Google) To: Linus Torvalds Cc: Masami Hiramatsu (Google) , Steven Rostedt , Masami Hiramatsu , linux-kernel@vger.kernel.org Subject: [GIT PULL] probes: Fixes for v7.2-rc4 Message-Id: <20260721175715.3108a5392f116ce1f79ced53@kernel.org> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Hi Linus, Probes fixes for v7.2-rc4: - tracing/probes: Avoid temporary buffer truncation in match_command_args() Compare argument name, delimiter, and comm expression directly instead of formatting into a stack buffer to prevent false matching failures. - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Return early when trace_probe_log.argc is zero to prevent out-of-bounds access when constructing the formatted error command string. - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Ensure buffer length is greater than current position before subtraction to prevent unsigned size underflow when formatting print strings. - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() Check system name null-termination to avoid partial prefix matching when comparing event probe target system names. Please pull the latest probes-fixes-v7.2-rc4 tree, which can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git probes-fixes-v7.2-rc4 Tag SHA1: 6d2f87b0578e842cc95e5d935411333ae5d999ab Head SHA1: f418d68d71fd4a0a9cef92377bc8c4c3334b5b53 Masami Hiramatsu (Google) (4): tracing/probes: Avoid temporary buffer truncation in trace_probe_matc= h_command_args() tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() tracing/probes: Fix potential underflow in LEN_OR_ZERO macro tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_ma= tch() ---- kernel/trace/trace_eprobe.c | 3 ++- kernel/trace/trace_probe.c | 13 +++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) --------------------------- diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c index 50518b071414..bcd97cb24ac9 100644 --- a/kernel/trace/trace_eprobe.c +++ b/kernel/trace/trace_eprobe.c @@ -172,7 +172,8 @@ static bool eprobe_dyn_event_match(const char *system, = const char *event, if (!slash) return false; =20 - if (strncmp(ep->event_system, argv[0], slash - argv[0])) + if (strncmp(ep->event_system, argv[0], slash - argv[0]) || + ep->event_system[slash - argv[0]] !=3D '\0') return false; if (strcmp(ep->event_name, slash + 1)) return false; diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index d17cfee77d9c..506e6037e163 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -188,7 +188,7 @@ void __trace_probe_log_err(int offset, int err_type) =20 lockdep_assert_held(&dyn_event_ops_mutex); =20 - if (!trace_probe_log.argv) + if (!trace_probe_log.argv || !trace_probe_log.argc) return; =20 /* Recalculate the length and allocate buffer */ @@ -2013,7 +2013,7 @@ int traceprobe_update_arg(struct probe_arg *arg) } =20 /* When len=3D0, we just calculate the needed length */ -#define LEN_OR_ZERO (len ? len - pos : 0) +#define LEN_OR_ZERO (len > pos ? len - pos : 0) static int __set_print_fmt(struct trace_probe *tp, char *buf, int len, enum probe_print_type ptype) { @@ -2338,16 +2338,17 @@ int trace_probe_compare_arg_type(struct trace_probe= *a, struct trace_probe *b) bool trace_probe_match_command_args(struct trace_probe *tp, int argc, const char **argv) { - char buf[MAX_ARGSTR_LEN + 1]; int i; =20 if (tp->nr_args < argc) return false; =20 for (i =3D 0; i < argc; i++) { - snprintf(buf, sizeof(buf), "%s=3D%s", - tp->args[i].name, tp->args[i].comm); - if (strcmp(buf, argv[i])) + int len =3D strlen(tp->args[i].name); + + if (strncmp(argv[i], tp->args[i].name, len) || + argv[i][len] !=3D '=3D' || + strcmp(argv[i] + len + 1, tp->args[i].comm)) return false; } return true; --=20 Masami Hiramatsu (Google)