From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from confino.investici.org (confino.investici.org [93.190.126.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0FEFE292B54 for ; Sun, 5 Jul 2026 16:41:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.190.126.19 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783269689; cv=none; b=BivSdMU7l+ztUMIiYtv8nrWlF4gmkeamG4jYC691S9WcQVYb3mgMLFnNcTYx5JLVXTQTQM6VEk02xoSXuTvr1NdrsBU1k2ShwqXt0AJNE2jZ6xagTT0SG78CJKgfEouGkuXgyWpbHtyr30CbcBf0gLI4vuJAvgJ+g1Y7ijcSpAE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783269689; c=relaxed/simple; bh=OIR0bib+TFDONY52z/n/uqjQ0P0K00njC4uEMuF7kwU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GE63X118l1wgPeu3W4Tyt3/6z3FXsb4SVbPuH/nPb+g7JcSXwZzvpZwUa7C2Q1ktByuDibkenPZ6ZsYT/iVFf/YA+M3gnbzqUx42PLPyPLHhXJi8Ptant4rFSIBpzfGbjbsGEbJQmhNHKvcGOspE0IWuq01X7wPfX2O2m7gFCIA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=grrlz.net; spf=pass smtp.mailfrom=grrlz.net; dkim=pass (1024-bit key) header.d=grrlz.net header.i=@grrlz.net header.b=GxnEjr1c; arc=none smtp.client-ip=93.190.126.19 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=grrlz.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=grrlz.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=grrlz.net header.i=@grrlz.net header.b="GxnEjr1c" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=grrlz.net; s=stigmate; t=1783269683; bh=QnrWerRGVrfyeFTU0Khei3YVIrvNMCShJMOrglS4Au8=; h=From:To:Cc:Subject:Date:From; b=GxnEjr1cwXy7T1CS6XXW7koLsp+cK/MQ43GhQ4fkqAp3VVC4nz7i0b9TpBVAoBXu/ Q4G0FgEgR++wDtwXfNidVmz8Ali0Q2bBSiT2Ck07Ds6DccITW+IHZxAh5r8glPmZj2 MXQuyUO00W4uiPZ11ypyD/Qx9njSGNijSxEOhWvA= Received: from mx1.investici.org (unknown [127.0.0.1]) by confino.investici.org (Postfix) with ESMTP id 4gtYCl5GBkz110W; Sun, 05 Jul 2026 16:41:23 +0000 (UTC) Received: by mx1.investici.org (Postfix) id 4gtYCl1zR6z10sQ; Sun, 05 Jul 2026 16:41:23 +0000 (UTC) From: Bradley Morgan To: Andrew Morton , Feng Tang Cc: Petr Mladek , Jinchao Wang , linux-kernel@vger.kernel.org, Bradley Morgan Subject: [PATCH] panic: fix va_list reuse in panic_try_force_cpu() Date: Sun, 5 Jul 2026 16:41:23 +0000 Message-ID: <20260705164123.18746-1-include@grrlz.net> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit vsnprintf() consumes the caller's va_list. When the redirect fails, vpanic() reuses it for the panic message, which is undefined behavior. Use va_copy(). Signed-off-by: Bradley Morgan --- kernel/panic.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kernel/panic.c b/kernel/panic.c index f9ad0250da67..03f1eef07b17 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -412,7 +412,12 @@ static bool panic_try_force_cpu(const char *fmt, va_list args) * fall back to static message for early boot panics or allocation failure. */ if (panic_force_buf) { - vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, args); + va_list ap; + + /* Do not consume args, the caller reuses it if we fail */ + va_copy(ap, args); + vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, ap); + va_end(ap); msg = panic_force_buf; } else { msg = "Redirected panic (buffer unavailable)"; -- 2.53.0