From: Andrew Morton <akpm@linux-foundation.org>
To: Bradley Morgan <include@grrlz.net>
Cc: Feng Tang <feng.tang@linux.alibaba.com>,
Petr Mladek <pmladek@suse.com>,
Jinchao Wang <wangjinchao600@gmail.com>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] panic: fix va_list reuse in panic_try_force_cpu()
Date: Sun, 5 Jul 2026 12:10:14 -0700 [thread overview]
Message-ID: <20260705121014.d783e021f38f262faf2404f2@linux-foundation.org> (raw)
In-Reply-To: <20260705164123.18746-1-include@grrlz.net>
On Sun, 5 Jul 2026 16:41:23 +0000 Bradley Morgan <include@grrlz.net> wrote:
> vsnprintf() consumes the caller's va_list. When the redirect fails,
> vpanic() reuses it for the panic message, which is undefined
> behavior. Use va_copy().
Thanks.
> --- a/kernel/panic.c
> +++ b/kernel/panic.c
> @@ -412,7 +412,12 @@ static bool panic_try_force_cpu(const char *fmt, va_list args)
> * fall back to static message for early boot panics or allocation failure.
> */
> if (panic_force_buf) {
> - vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, args);
> + va_list ap;
> +
> + /* Do not consume args, the caller reuses it if we fail */
Nice comment!
> + va_copy(ap, args);
> + vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, ap);
> + va_end(ap);
> msg = panic_force_buf;
> } else {
> msg = "Redirected panic (buffer unavailable)";
AI review found a possible pre-existing thing in there (as usual,
sigh). Seems pretty improbable:
https://sashiko.dev/#/patchset/20260705164123.18746-1-include@grrlz.net
prev parent reply other threads:[~2026-07-05 19:10 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-05 16:41 [PATCH] panic: fix va_list reuse in panic_try_force_cpu() Bradley Morgan
2026-07-05 19:10 ` Andrew Morton [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260705121014.d783e021f38f262faf2404f2@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=feng.tang@linux.alibaba.com \
--cc=include@grrlz.net \
--cc=linux-kernel@vger.kernel.org \
--cc=pmladek@suse.com \
--cc=wangjinchao600@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox