[to-be-updated] panic-fix-va_list-reuse-in-panic_try_force_cpu.patch removed from -mm tree

[to-be-updated] panic-fix-va_list-reuse-in-panic_try_force_cpu.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: panic: fix va_list reuse in panic_try_force_cpu()
has been removed from the -mm tree.  Its filename was
     panic-fix-va_list-reuse-in-panic_try_force_cpu.patch

This patch was dropped because an updated version will be issued

------------------------------------------------------
From: Bradley Morgan <include@grrlz.net>
Subject: panic: fix va_list reuse in panic_try_force_cpu()
Date: Sun, 5 Jul 2026 16:41:23 +0000

vsnprintf() consumes the caller's va_list. When the redirect fails,
vpanic() reuses it for the panic message, which is undefined
behavior. Use va_copy().

Link: https://lore.kernel.org/20260705164123.18746-1-include@grrlz.net
Signed-off-by: Bradley Morgan <include@grrlz.net>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 kernel/panic.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/kernel/panic.c~panic-fix-va_list-reuse-in-panic_try_force_cpu
+++ a/kernel/panic.c
@@ -412,7 +412,12 @@ static bool panic_try_force_cpu(const ch
 	 * fall back to static message for early boot panics or allocation failure.
 	 */
 	if (panic_force_buf) {
-		vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, args);
+		va_list ap;
+
+		/* Do not consume args, the caller reuses it if we fail */
+		va_copy(ap, args);
+		vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, ap);
+		va_end(ap);
 		msg = panic_force_buf;
 	} else {
 		msg = "Redirected panic (buffer unavailable)";
_

Patches currently in -mm which might be from include@grrlz.net are

lib-string-fix-memchr_inv-for-large-ranges.patch
signal-avoid-shared-siginfo-namespace-rewrites.patch
reboot-use-lookup-tables-for-sysfs-mode-and-type-strings.patch
reboot-use-a-lookup-table-for-hw_protection_action-strings.patch