Re: [PATCH v6 15/19] treewide: Replace some uses of str_has_prefix() by strprefix()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] tracing: NULL pointer dereference in trace_set_options()
--

commit c09c1b839b46a18b156e43281c4fb679a76cfe40
Author: Alejandro Colomar <alx@kernel.org>

treewide: Replace some uses of str_has_prefix() by strprefix()

This commit replaces several callers of str_has_prefix() across the tree
with strprefix() to avoid manual pointer arithmetic.

> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 4ccdefb5c3efe..f9f3faaede094 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -4085,19 +4085,18 @@ int set_tracer_flag(struct trace_array *tr, u64 mask, int enabled)
>  
>  int trace_set_options(struct trace_array *tr, char *option)
>  {
> -	char *cmp;
> +	char *cmp, *p;
>  	int neg = 0;
>  	int ret;
>  	size_t orig_len = strlen(option);
> -	int len;
>  
>  	cmp = strstrip(option);
>  
> -	len = str_has_prefix(cmp, "no");
> -	if (len)
> +	p = strprefix(cmp, "no");
> +	if (p)
>  		neg = 1;
>  
> -	cmp += len;
> +	cmp = p;

[Severity: High]
Does this set cmp to NULL when the option does not start with "no"?
strprefix() returns NULL on a non-match, and "cmp = p;" runs outside the
"if (p)" check, causing a NULL pointer dereference when cmp is passed to
match_string() right below.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1794667407.git.alx@kernel.org?part=15