> Date: 2026-11-14 15:34:40+0000
> From: sashiko-bot@kernel.org
>
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [High] tracing: NULL pointer dereference in trace_set_options()
> --
> 
> commit c09c1b839b46a18b156e43281c4fb679a76cfe40
> Author: Alejandro Colomar <alx@kernel.org>
> 
> treewide: Replace some uses of str_has_prefix() by strprefix()
> 
> This commit replaces several callers of str_has_prefix() across the tree
> with strprefix() to avoid manual pointer arithmetic.
> 
> > diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> > index 4ccdefb5c3efe..f9f3faaede094 100644
> > --- a/kernel/trace/trace.c
> > +++ b/kernel/trace/trace.c
> > @@ -4085,19 +4085,18 @@ int set_tracer_flag(struct trace_array *tr, u64 mask, int enabled)
> >  
> >  int trace_set_options(struct trace_array *tr, char *option)
> >  {
> > -	char *cmp;
> > +	char *cmp, *p;
> >  	int neg = 0;
> >  	int ret;
> >  	size_t orig_len = strlen(option);
> > -	int len;
> >  
> >  	cmp = strstrip(option);
> >  
> > -	len = str_has_prefix(cmp, "no");
> > -	if (len)
> > +	p = strprefix(cmp, "no");
> > +	if (p)
> >  		neg = 1;
> >  
> > -	cmp += len;
> > +	cmp = p;

Ouch!  I meant to write 'cmp = p ?: cmp;'.

Will fix for v7.

> 
> [Severity: High]
> Does this set cmp to NULL when the option does not start with "no"?
> strprefix() returns NULL on a non-match, and "cmp = p;" runs outside the
> "if (p)" check, causing a NULL pointer dereference when cmp is passed to
> match_string() right below.
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/cover.1794667407.git.alx@kernel.org?part=15

-- 
<https://www.alejandro-colomar.es>