linux-stable.git/arch/s390/kernel/debug.c, branch linux-rolling-lts

s390/debug: Reject zero-length input before trimming a newline

2026-05-14T13:30:20+00:00

commit c366a7b5ed7564e41345c380285bd3f6cb98971b upstream.

debug_get_user_string() duplicates the userspace buffer with
memdup_user_nul() and then unconditionally looks at buffer[user_len - 1]
to strip a trailing newline.

A zero-length write reaches this helper unchanged, so the newline trim
reads before the start of the allocated buffer.

Reject empty writes before accessing the last input byte.

Fixes: 66a464dbc8e0 ("[PATCH] s390: debug feature changes")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou 
Reviewed-by: Benjamin Block 
Reviewed-by: Vasily Gorbik 
Tested-by: Vasily Gorbik 
Link: https://lore.kernel.org/r/20260417073530.96002-1-pengpeng@iscas.ac.cn
Signed-off-by: Vasily Gorbik 
Signed-off-by: Alexander Gordeev 
Signed-off-by: Greg Kroah-Hartman

s390/debug: Reject zero-length input in debug_input_flush_fn()

2026-05-14T13:30:20+00:00

commit e14622a7584f9608927c59a7d6ae4a0999dc545e upstream.

debug_input_flush_fn() always copies one byte from the userspace buffer
with copy_from_user() regardless of the supplied write length. A
zero-length write therefore reads one byte beyond the caller's buffer.
If the stale byte happens to be '-' or a digit the debug log is
silently flushed. With an unmapped buffer the call returns -EFAULT.

Reject zero-length writes before copying from userspace.

Cc: stable@vger.kernel.org # v5.10+
Acked-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik 
Signed-off-by: Alexander Gordeev 
Signed-off-by: Greg Kroah-Hartman

s390/debug: Replace kmalloc() + copy_from_user() with memdup_user_nul()

2025-09-09T13:03:12+00:00

Replace kmalloc() followed by copy_from_user() with memdup_user_nul() to
improve and simplify debug_get_user_string(). Remove the manual
NUL-termination.

No functional changes intended.

Signed-off-by: Thorsten Blum 
Reviewed-by: Niklas Schnelle 
Signed-off-by: Alexander Gordeev

s390/debug: Fix typo in debug_sprintf_format_fn() comment

2025-08-06T15:18:27+00:00

Signed-off-by: Tigran Mkrtchyan 
Link: https://lore.kernel.org/r/20250804093321.434674-1-tigran.mkrtchyan@desy.de
Signed-off-by: Alexander Gordeev

s390: Remove optional third argument of strscpy() if possible

2025-04-17T13:16:10+00:00

The third argument of strscpy() is optional and can be left away iff
the destination is an array and the maximum size of the copy is the
size of destination.
Remove the third argument for those cases where this is possible.

Acked-by: Alexander Gordeev 
Signed-off-by: Heiko Carstens

treewide: const qualify ctl_tables where applicable

2025-01-28T12:48:37+00:00

Add the const qualifier to all the ctl_tables in the tree except for
watchdog_hardlockup_sysctl, memory_allocation_profiling_sysctls,
loadpin_sysctl_table and the ones calling register_net_sysctl (./net,
drivers/inifiniband dirs). These are special cases as they use a
registration function with a non-const qualified ctl_table argument or
modify the arrays before passing them on to the registration function.

Constifying ctl_table structs will prevent the modification of
proc_handler function pointers as the arrays would reside in .rodata.
This is made possible after commit 78eb4ea25cd5 ("sysctl: treewide:
constify the ctl_table argument of proc_handlers") constified all the
proc_handlers.

Created this by running an spatch followed by a sed command:
Spatch:
    virtual patch

    @
    depends on !(file in "net")
    disable optional_qualifier
    @

    identifier table_name != {
      watchdog_hardlockup_sysctl,
      iwcm_ctl_table,
      ucma_ctl_table,
      memory_allocation_profiling_sysctls,
      loadpin_sysctl_table
    };
    @@

    + const
    struct ctl_table table_name [] = { ... };

sed:
    sed --in-place \
      -e "s/struct ctl_table .table = &uts_kern/const struct ctl_table *table = \&uts_kern/" \
      kernel/utsname_sysctl.c

Reviewed-by: Song Liu 
Acked-by: Steven Rostedt (Google)  # for kernel/trace/
Reviewed-by: Martin K. Petersen  # SCSI
Reviewed-by: Darrick J. Wong  # xfs
Acked-by: Jani Nikula 
Acked-by: Corey Minyard 
Acked-by: Wei Liu 
Acked-by: Thomas Gleixner 
Reviewed-by: Bill O'Donnell 
Acked-by: Baoquan He 
Acked-by: Ashutosh Dixit 
Acked-by: Anna Schumaker 
Signed-off-by: Joel Granados

s390/pci: Add pci_msg debug view to PCI report

2024-12-16T15:14:27+00:00

Using the newly introduced debug_dump() mechanism add formatted content
of pci_debug_msg_id to the PCI report. The formatting is based on the
existing sprintf format but removes caller pointer and area index and
adds an column header. This will allow the platform to collect this log
data together with hardware errors. This sets the reverse flag such that
the newest log entries get added to the PCI report even if not all debug
log entries fit.

Reviewed-by: Halil Pasic 
Co-developed-by: Halil Pasic 
Signed-off-by: Halil Pasic 
Signed-off-by: Niklas Schnelle 
Signed-off-by: Alexander Gordeev

s390/debug: Add a reverse mode for debug_dump()

2024-12-16T15:14:26+00:00

In this mode debug_dump() writes the debug log starting at the newest
entry followed by earlier entries. To this end add a debug_prev_entry()
helper analogous to debug_next_entry() a helper to get the latest entry
which is one before the active entry and a helper to iterate either
forward or backward.

Reviewed-by: Halil Pasic 
Co-developed-by: Halil Pasic 
Signed-off-by: Halil Pasic 
Signed-off-by: Niklas Schnelle 
Signed-off-by: Alexander Gordeev

s390/debug: Add debug_dump() to write debug view to a string buffer

2024-12-16T15:14:26+00:00

The debug_dump() function allows to get the content of a debug log and
view pair in a string buffer. One future application of this is to
provide debug logs to the platform to be collected with hardware error
logs during recovery.

Reviewed-by: Halil Pasic 
Co-developed-by: Halil Pasic 
Signed-off-by: Halil Pasic 
Signed-off-by: Niklas Schnelle 
Signed-off-by: Alexander Gordeev

s390/debug: Split private data alloc/free out of file operations

2024-12-16T15:14:26+00:00

Split the allocation respectively freeing of file_private_info_t out
of open() respectively close(). This will be used in a follow on change
to access to debug views without going through the s390dbf filesystem.

Reviewed-by: Halil Pasic 
Signed-off-by: Niklas Schnelle 
Signed-off-by: Alexander Gordeev