[GIT PULL] probes: Fixes for v7.0-rc7

[Masami Hiramatsu (Google) <mhiramat@kernel.org>]

Hi Linus,

Probes fixes for v7.0-rc7

- tracing/probe: reject non-closed empty immediate strings
  Fixed a buffer index underflow bug that occurred when passing an
  non-closed empty immediate string to the probe event.


Please pull the latest probes-fixes-v7.0-rc7 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
probes-fixes-v7.0-rc7

Tag SHA1: 0c7333fa2ead5a8cd9bbd9825fd034eecf23fb70
Head SHA1: 4346be6577aaa04586167402ae87bbdbe32484a4


Pengpeng Hou (1):
      tracing/probe: reject non-closed empty immediate strings

----
 kernel/trace/trace_probe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
---------------------------
commit 4346be6577aaa04586167402ae87bbdbe32484a4
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date:   Thu Apr 2 00:03:15 2026 +0800

    tracing/probe: reject non-closed empty immediate strings
    
    parse_probe_arg() accepts quoted immediate strings and passes the body
    after the opening quote to __parse_imm_string(). That helper currently
    computes strlen(str) and immediately dereferences str[len - 1], which
    underflows when the body is empty and not closed with double-quotation.
    
    Reject empty non-closed immediate strings before checking for the closing quote.
    
    Link: https://lore.kernel.org/all/20260401160315.88518-1-pengpeng@iscas.ac.cn/
    
    Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support")
    Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
    Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index e0a5dc86c07e..e1c73065dae5 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -1068,7 +1068,7 @@ static int __parse_imm_string(char *str, char **pbuf, int offs)
 {
 	size_t len = strlen(str);
 
-	if (str[len - 1] != '"') {
+	if (!len || str[len - 1] != '"') {
 		trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE);
 		return -EINVAL;
 	}

-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>