On Wed, Sep 23, 2026 at 4:52 PM <[email protected]> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s)
> to consider:
> - [High] lib: Kernel oops when modifying string literal in ddebug_exec_queries
> --
>
> commit 33851d8d7a58ba9b9a4cd975835feabf66d636db
> Author: Jim Cromie <[email protected]>
>
> dyndbg: add +c flag to count pr_debug calls without printing
>
> This commit introduces a new "+c" flag for dynamic debug to count pr_debug
> calls without actually printing them, saving memory bandwidth. It adds a
> per-CPU counter for the hits and a "reset_stats" control command to clear
> the counters.
>
> > diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
> > index 88440c1f6abba..9b789287afe56 100644
> > --- a/lib/dynamic_debug.c
> > +++ b/lib/dynamic_debug.c
>
> [ ... ]
>
> > @@ -727,6 +745,11 @@ static int ddebug_exec_queries(char *query, const char
> > *modname)
> > if (!query || !*query || *query == '#')
> > continue;
> >
> > + if (!strcmp(strstrip(query), "reset_stats")) {
>
> [Severity: High]
> Will this cause a kernel oops when parsing module parameters?
>
> If a user supplies the dyndbg or module.dyndbg parameter without an
> explicit value, ddebug_dyndbg_param_cb() handles it by falling back to
> a string literal:
>
> ddebug_exec_queries((val ? val : "+p"), modname);
>
> Since strstrip() modifies the string in-place by writing a null byte at
> the end of the processed string, passing the read-only literal "+p" will
> attempt a write to the .rodata section and crash the kernel during boot or
> module load.
>
Confirmed and fixed for v12.
strstrip() calls strim(), which unconditionally writes a null terminator
to *(end + 1), faulting on read-only literals in .rodata.
Fixed by:
0. Replacing strstrip() with a non-mutating check in
ddebug_exec_queries():
if (!strncmp(query, "reset_stats", 11) &&
!*skip_spaces_and_commas(query + 11))
1. Passing a mutable static buffer from ddebug_dyndbg_param_cb():
static char dflt[] = "+p";
ddebug_exec_queries((val ? val : dflt), modname);
> > + reset_ddebug_call_count();
> > + continue;
> > + }
> > +
> > if (modname)
> > v2pr_info("query %d: module %s \"%s\"\n", i, modname,
> > query);
> > else
>
> --
> Sashiko AI review ·
> https://sashiko.dev/#/patchset/[email protected]?part=37
