[PATCH] tracing/probes: Reject $arg0 in meta argument expansion

[PATCH] tracing/probes: Reject $arg0 in meta argument expansion

[Raushan Patel]

traceprobe_expand_meta_args() parses $argN with simple_strtoul() and
calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is
-1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in
sprint_nth_btf_arg() does not catch the negative index, and
ctx->params[-1].name_off is read out of bounds.

The normal per-argument path (parse_probe_vars()) already rejects
$arg0 via its argument-number check, but meta-argument expansion runs
before per-argument parsing and substitutes the value first, bypassing
that check.

Reject $arg0 explicitly during expansion.

Fixes: 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args")
Signed-off-by: Raushan Patel <raushan.jhon@gmail.com>
---
 kernel/trace/trace_probe.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index 506e6037e163..c8fd9b946f44 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -1901,7 +1901,11 @@ const char **traceprobe_expand_meta_args(int argc, const char *argv[],
 				trace_probe_log_err(0, BAD_VAR);
 				return ERR_PTR(-ENOENT);
 			}
-			/* Note: $argN starts from $arg1 */
+			/* Note: $argN starts from $arg1, so $arg0 is invalid. */
+			if (n == 0) {
+				trace_probe_log_err(0, BAD_ARG_NUM);
+				return ERR_PTR(-EINVAL);
+			}
 			ret = sprint_nth_btf_arg(n - 1, type, buf + used,
 						 bufsize - used, ctx);
 			if (ret < 0)
-- 
2.53.0

Re: [PATCH] tracing/probes: Reject $arg0 in meta argument expansion

[Masami Hiramatsu]

On Fri, 24 Jul 2026 11:14:35 +0530
Raushan Patel <raushan.jhon@gmail.com> wrote:

> traceprobe_expand_meta_args() parses $argN with simple_strtoul() and
> calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is
> -1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in
> sprint_nth_btf_arg() does not catch the negative index, and
> ctx->params[-1].name_off is read out of bounds.
> 
> The normal per-argument path (parse_probe_vars()) already rejects
> $arg0 via its argument-number check, but meta-argument expansion runs
> before per-argument parsing and substitutes the value first, bypassing
> that check.
> 
> Reject $arg0 explicitly during expansion.

Good catch! Let me pick this.

Thanks!

> 
> Fixes: 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args")
> Signed-off-by: Raushan Patel <raushan.jhon@gmail.com>
> ---
>  kernel/trace/trace_probe.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
> index 506e6037e163..c8fd9b946f44 100644
> --- a/kernel/trace/trace_probe.c
> +++ b/kernel/trace/trace_probe.c
> @@ -1901,7 +1901,11 @@ const char **traceprobe_expand_meta_args(int argc, const char *argv[],
>  				trace_probe_log_err(0, BAD_VAR);
>  				return ERR_PTR(-ENOENT);
>  			}
> -			/* Note: $argN starts from $arg1 */
> +			/* Note: $argN starts from $arg1, so $arg0 is invalid. */
> +			if (n == 0) {
> +				trace_probe_log_err(0, BAD_ARG_NUM);
> +				return ERR_PTR(-EINVAL);
> +			}
>  			ret = sprint_nth_btf_arg(n - 1, type, buf + used,
>  						 bufsize - used, ctx);
>  			if (ret < 0)
> -- 
> 2.53.0
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>