From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF69235F60F for ; Wed, 29 Jul 2026 23:53:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785369217; cv=none; b=I5dCpxa9MhN7KlFlT8RyheaUINHbB2oSRqU158lmxB/v6SnlqwMGPUGQHwoa1P8Q97ZB6jcLiPjxByClbqEqj/ZKzBdFMDfLhVclJPh3t5s3Q0KLIPcQGZ5GFPOojmbIG4PzTKLeYie6Qng6rL1vq0Yf0ZYNdcGrOyFQ4tJwIYs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785369217; c=relaxed/simple; bh=RZz0MnzaL9T0Uxk0W1mb+O//NC3Ssrd+FSfyVGDDZYQ=; h=Date:From:To:Cc:Subject:Message-Id:Mime-Version:Content-Type; b=i/A4T3GlBkjdx3NqXSskcY+fqs6hBprdRCplwrMjegrhgo1J7qimWkkTSezBG6HeOt/oVf+4G7ksrIUuQgV1MTaa/po6Dj88l1azLY3xwQsAetFKZXPuqFWp8l9L6iVZBkG7wbIy9GEXssADUSZclGKa0up2TMUGaJuCO2ZuSMQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=f6khWUjC; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="f6khWUjC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F6DB1F000E9; Wed, 29 Jul 2026 23:53:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785369215; bh=IIjncUghI30s1hSkS6rsu8/fP3fgPXVOPvm/8F6xrqc=; h=Date:From:To:Cc:Subject; b=f6khWUjCwlVSNF0G3WN2+S0ISvAZJXACJCUMD98eiCvrJL6Jx/y33g7wL8wew6/0D X+QTsX62SEfq/2hWyaOpKYQXkMAHwMzBeUxFw6ocNaRIdzitaJ4PoN2BZpzLu0heuT +eGJ2UsCi5JFmIwSA/WuYiAv4yGtprMJ+skMhjPexk6zneKPPsQGpU+5N/UJsZ/b4N fXApuOjp685Z+meGXZP+bb/Pa9219xe0TLk9NFgjT+vuJJwzYHVduzEpnuO9T2EYWd m1uIRbjF6Ukg0XHp+xGe4ywd00QeQMZPkvGXmTSKHfWL8mSz61ysNEVXwI0p52Jp31 /wbu6JfQsIgWA== Date: Thu, 30 Jul 2026 08:53:31 +0900 From: Masami Hiramatsu (Google) To: Linus Torvalds Cc: Masami Hiramatsu (Google) , Raushan Patel , Steven Rostedt , Masami Hiramatsu , linux-kernel@vger.kernel.org Subject: [GIT PULL] probes: Fixes for v7.2-rc5 Message-Id: <20260730085331.ba142bae2b205913b35820e4@kernel.org> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Hi Linus, Probes fixes for v7.2-rc5: - tracing/probes: Reject $arg0 in meta argument expansion Reject $arg0 during meta-argument expansion to prevent negative index calculation and out-of-bounds reading of traceprobe parameters. - tracing/fprobe: Roll back on enable_trace_fprobe() failure Add a rollback cleanup path when __register_trace_fprobe() fails partway through to unregister registered probes and clear flags or file links. - fprobe: Fix module reference count leak on error in register_fprobe() Ensure the module_put() cleanup loop runs even when get_ips_from_filter() returns an error, preventing module reference count leaks. Please pull the latest probes-fixes-v7.2-rc5 tree, which can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git probes-fixes-v7.2-rc5 Tag SHA1: 5778b1358adb798fbe1c2ac1381be8bce98b60fc Head SHA1: 8cf2f40ceb85047ad8a84dffae3bebc9fed18216 Masami Hiramatsu (Google) (1): fprobe: Fix module reference count leak on error in register_fprobe() Raushan Patel (2): tracing/probes: Reject $arg0 in meta argument expansion tracing/fprobe: Roll back on enable_trace_fprobe() failure ---- kernel/trace/fprobe.c | 6 ++---- kernel/trace/trace_fprobe.c | 12 +++++++++++- kernel/trace/trace_probe.c | 6 +++++- 3 files changed, 18 insertions(+), 6 deletions(-) --------------------------- diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c index f215990b9061..f681015413b8 100644 --- a/kernel/trace/fprobe.c +++ b/kernel/trace/fprobe.c @@ -961,10 +961,8 @@ int register_fprobe(struct fprobe *fp, const char *filter, const char *notfilter return -ENOMEM; ret = get_ips_from_filter(filter, notfilter, addrs, mods, num); - if (ret < 0) - return ret; - - ret = register_fprobe_ips(fp, addrs, ret); + if (ret >= 0) + ret = register_fprobe_ips(fp, addrs, ret); for (int i = 0; i < num; i++) { if (mods[i]) diff --git a/kernel/trace/trace_fprobe.c b/kernel/trace/trace_fprobe.c index 9f5f08c0e7c2..3120403a5b60 100644 --- a/kernel/trace/trace_fprobe.c +++ b/kernel/trace/trace_fprobe.c @@ -1481,11 +1481,21 @@ static int enable_trace_fprobe(struct trace_event_call *call, list_for_each_entry(tf, trace_probe_probe_list(tp), tp.list) { ret = __register_trace_fprobe(tf); if (ret < 0) - return ret; + goto err; } } return 0; + +err: + /* Failed to enable one of them. Roll back all */ + list_for_each_entry(tf, trace_probe_probe_list(tp), tp.list) + __unregister_trace_fprobe(tf); + if (file) + trace_probe_remove_file(tp, file); + else + trace_probe_clear_flag(tp, TP_FLAG_PROFILE); + return ret; } /* diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 506e6037e163..c8fd9b946f44 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -1901,7 +1901,11 @@ const char **traceprobe_expand_meta_args(int argc, const char *argv[], trace_probe_log_err(0, BAD_VAR); return ERR_PTR(-ENOENT); } - /* Note: $argN starts from $arg1 */ + /* Note: $argN starts from $arg1, so $arg0 is invalid. */ + if (n == 0) { + trace_probe_log_err(0, BAD_ARG_NUM); + return ERR_PTR(-EINVAL); + } ret = sprint_nth_btf_arg(n - 1, type, buf + used, bufsize - used, ctx); if (ret < 0) -- Masami Hiramatsu (Google)