I would like to suggest the subject as "tracing/probe: Reject non-closed empty immediate strings"
On Thu, 2 Apr 2026 00:03:15 +0800 Pengpeng Hou <[email protected]> wrote: > parse_probe_arg() accepts quoted immediate strings and passes the body > after the opening quote to __parse_imm_string(). That helper currently > computes strlen(str) and immediately dereferences str[len - 1], which > underflows when the body is empty. ^ and not closed with double-quotation. > > Reject empty immediate strings before checking for the closing quote. ^ non-closed. Thank you, > > Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support") > Signed-off-by: Pengpeng Hou <[email protected]> > --- > Changes since v1: > - resend as a standalone patch instead of part of an accidental > cross-subsystem 1/4 series > > kernel/trace/trace_probe.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c > index e0a5dc86c07e..e1c73065dae5 100644 > --- a/kernel/trace/trace_probe.c > +++ b/kernel/trace/trace_probe.c > @@ -1068,7 +1068,7 @@ static int __parse_imm_string(char *str, char **pbuf, > int offs) > { > size_t len = strlen(str); > > - if (str[len - 1] != '"') { > + if (!len || str[len - 1] != '"') { > trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE); > return -EINVAL; > } > -- > 2.50.1 (Apple Git-155) > -- Masami Hiramatsu (Google) <[email protected]>
