traceprobe_expand_meta_args() parses $argN with simple_strtoul() and calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is -1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in sprint_nth_btf_arg() does not catch the negative index, and ctx->params[-1].name_off is read out of bounds. The normal per-argument path (parse_probe_vars()) already rejects $arg0 via its argument-number check, but meta-argument expansion runs before per-argument parsing and substitutes the value first, bypassing that check. Reject $arg0 explicitly during expansion. Link: https://lore.kernel.org/all/20260724054435.146279-1-raushan.jhon@gmail.com/
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -1901,7 +1901,11 @@ const char **traceprobe_expand_meta_args(int argc, const char *argv[], · 1900 unmodified lines | ||
| 1901 | 1901 | trace_probe_log_err(0, BAD_VAR); |
| 1902 | 1902 | return ERR_PTR(-ENOENT); |
| 1903 | 1903 | } |
| 1904 | − /* Note: $argN starts from $arg1 */ | |
| 1904 | + /* Note: $argN starts from $arg1, so $arg0 is invalid. */ | |
| 1905 | + if (n == 0) { | |
| 1906 | + trace_probe_log_err(0, BAD_ARG_NUM); | |
| 1907 | + return ERR_PTR(-EINVAL); | |
| 1908 | + } | |
| 1905 | 1909 | ret = sprint_nth_btf_arg(n - 1, type, buf + used, |
| 1906 | 1910 | bufsize - used, ctx); |
| 1907 | 1911 | if (ret < 0) |