mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 03:27:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'probes-fixes-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Browse Source 
Pull probes fixes from Masami Hiramatsu:

 - Avoid temporary buffer truncation in match_command_args()

   Compare argument name, delimiter, and comm expression directly
   instead of formatting into a stack buffer to prevent false
   matching failures

 - Prevent out-of-bounds write in __trace_probe_log_err()

   Return early when trace_probe_log.argc is zero to prevent
   out-of-bounds access when constructing the formatted error
   command string

 - Fix potential underflow in LEN_OR_ZERO macro

   Ensure buffer length is greater than current position before
   subtraction to prevent unsigned size underflow when formatting
   print strings

 - Fix exact system name matching in eprobe_dyn_event_match()

   Check system name null-termination to avoid partial prefix
   matching when comparing event probe target system names

* tag 'probes-fixes-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
  tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
  tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
  tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
This commit is contained in:
Linus Torvalds
2026-07-21 08:18:27 -07:00
parent 51f247c4b2 f418d68d71
commit cdb65777c4
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
kernel/trace/trace_eprobe.c
View File

@@ -172,7 +172,8 @@ static bool eprobe_dyn_event_match(const char *system, const char *event,
if (!slash)
return false;
if (strncmp(ep->event_system, argv[0], slash - argv[0]))
if (strncmp(ep->event_system, argv[0], slash - argv[0]) ||
ep->event_system[slash - argv[0]] != '\0')
return false;
if (strcmp(ep->event_name, slash + 1))
return false;

13
kernel/trace/trace_probe.c
View File

@@ -188,7 +188,7 @@ void __trace_probe_log_err(int offset, int err_type)
lockdep_assert_held(&dyn_event_ops_mutex);
if (!trace_probe_log.argv)
if (!trace_probe_log.argv || !trace_probe_log.argc)
return;
/* Recalculate the length and allocate buffer */
@@ -2013,7 +2013,7 @@ int traceprobe_update_arg(struct probe_arg *arg)
}
/* When len=0, we just calculate the needed length */
#define LEN_OR_ZERO (len ? len - pos : 0)
#define LEN_OR_ZERO (len > pos ? len - pos : 0)
static int __set_print_fmt(struct trace_probe *tp, char *buf, int len,
enum probe_print_type ptype)
{
@@ -2338,16 +2338,17 @@ int trace_probe_compare_arg_type(struct trace_probe *a, struct trace_probe *b)
bool trace_probe_match_command_args(struct trace_probe *tp,
int argc, const char **argv)
{
char buf[MAX_ARGSTR_LEN + 1];
int i;
if (tp->nr_args < argc)
return false;
for (i = 0; i < argc; i++) {
snprintf(buf, sizeof(buf), "%s=%s",
tp->args[i].name, tp->args[i].comm);
if (strcmp(buf, argv[i]))
int len = strlen(tp->args[i].name);
if (strncmp(argv[i], tp->args[i].name, len) ||
argv[i][len] != '=' ||
strcmp(argv[i] + len + 1, tp->args[i].comm))
return false;
}
return true;