CVE-2024-57930

In the Linux kernel, the following vulnerability has been resolved:

tracing: Have process_string() also allow arrays

In order to catch a common bug where a TRACEEVENT() TPfastassign() assigns an address of an allocated string to the ring buffer and then references it in TPprintk(), which can be executed hours later when the string is free, the function testeventprintk() runs on all events as they are registered to make sure there's no unwanted dereferencing.

It calls processstring() to handle cases in TPprintk() format that has "%s". It returns whether or not the string is safe. But it can have some false positives.

For instance, xebomove() has:

TPprintk("movelackssource:%s, migrate object %p [size %zu] from %s to %s deviceid:%s", entry->movelackssource ? "yes" : "no", _entry->bo, _entry->size, xememtypetoname[entry->oldplacement], xememtypetoname[entry->newplacement], _getstr(device_id))

Where the "%s" references into xememtypetoname[]. This is an array of pointers that should be safe for the event to access. Instead of flagging this as a bad reference, if a reference points to an array, where the record field is the index, consider it safe.