Re: [PATCH] panic: fix va_list reuse in panic_try_force_cpu()

[Andrew Morton]

On Sun,  5 Jul 2026 16:41:23 +0000 Bradley Morgan <include@xxxxxxxxx> wrote:

> vsnprintf() consumes the caller's va_list. When the redirect fails,
> vpanic() reuses it for the panic message, which is undefined
> behavior. Use va_copy().

Thanks.

> --- a/kernel/panic.c
> +++ b/kernel/panic.c
> @@ -412,7 +412,12 @@ static bool panic_try_force_cpu(const char *fmt, va_list args)
>  	 * fall back to static message for early boot panics or allocation failure.
>  	 */
>  	if (panic_force_buf) {
> -		vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, args);
> +		va_list ap;
> +
> +		/* Do not consume args, the caller reuses it if we fail */

Nice comment!

> +		va_copy(ap, args);
> +		vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, ap);
> +		va_end(ap);
>  		msg = panic_force_buf;
>  	} else {
>  		msg = "Redirected panic (buffer unavailable)";

AI review found a possible pre-existing thing in there (as usual,
sigh).  Seems pretty improbable:

	https://sashiko.dev/#/patchset/20260705164123.18746-1-include@xxxxxxxxx