diff options
| author | Bradley Morgan <brads@mainlining.org> | 2026-09-16 18:29:54 +0000 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-10-06 19:03:09 -0700 |
| commit | e97834b034a3d4de1f3c305a6dfcef7bb14989ad (patch) | |
| tree | 8b3513e533effebc5a7f66db10fe018c1d5753cb /kernel/panic.c | |
| parent | 50ce3620bee380cd2e136803ff66cc8c997d6d7c (diff) | |
| download | linux-next-e97834b034a3d4de1f3c305a6dfcef7bb14989ad.tar.gz linux-next-e97834b034a3d4de1f3c305a6dfcef7bb14989ad.zip | |
panic: fix va_list reuse in panic_try_force_cpu()
vsnprintf() consumes the caller's va_list. When the redirect fails,
vpanic() reuses it for the panic message, which is undefined behavior.
Use va_copy().
Link: https://lore.kernel.org/20260916182957.7788-4-brads@mainlining.org
Fixes: 2e171ab29f91 ("panic: add panic_force_cpu= parameter to redirect panic to a specific CPU")
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Guenetr Roeck <linux@roeck-us.net>
Cc: Sashiko <sashiko-bot@kernel.org>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: <stable@vger.kernel.org>
Diffstat (limited to 'kernel/panic.c')
| -rw-r--r-- | kernel/panic.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/kernel/panic.c b/kernel/panic.c index 5646d4fb82b7..7388eb81a1c4 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -417,7 +417,12 @@ static bool panic_try_force_cpu(const char *fmt, va_list args) * fall back to static message for early boot panics or allocation failure. */ if (panic_force_buf) { - vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, args); + va_list ap; + + /* Do not consume args, the caller reuses it if we fail */ + va_copy(ap, args); + vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, ap); + va_end(ap); msg = panic_force_buf; } else { msg = "Redirected panic (buffer unavailable)"; |