linux.git/arch/s390/kernel/debug.c, branch v5.10.258

s390/debug: Reject zero-length input before trimming a newline

2026-06-01T15:29:49+00:00

[ Upstream commit c366a7b5ed7564e41345c380285bd3f6cb98971b ]

debug_get_user_string() copies the userspace buffer into a newly
allocated NUL-terminated buffer and then unconditionally looks at
buffer[user_len - 1] to strip a trailing newline.

A zero-length write reaches this helper unchanged, so the newline trim
reads before the start of the allocated buffer.

Reject empty writes before accessing the last input byte.

Fixes: 66a464dbc8e0 ("[PATCH] s390: debug feature changes")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou 
Reviewed-by: Benjamin Block 
Reviewed-by: Vasily Gorbik 
Tested-by: Vasily Gorbik 
Link: https://lore.kernel.org/r/20260417073530.96002-1-pengpeng@iscas.ac.cn
Signed-off-by: Vasily Gorbik 
Signed-off-by: Alexander Gordeev 
Signed-off-by: Sasha Levin

s390/debug: Reject zero-length input in debug_input_flush_fn()

2026-06-01T15:29:26+00:00

commit e14622a7584f9608927c59a7d6ae4a0999dc545e upstream.

debug_input_flush_fn() always copies one byte from the userspace buffer
with copy_from_user() regardless of the supplied write length. A
zero-length write therefore reads one byte beyond the caller's buffer.
If the stale byte happens to be '-' or a digit the debug log is
silently flushed. With an unmapped buffer the call returns -EFAULT.

Reject zero-length writes before copying from userspace.

Cc: stable@vger.kernel.org # v5.10+
Acked-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik 
Signed-off-by: Alexander Gordeev 
Signed-off-by: Greg Kroah-Hartman

s390/debug: fix debug area life cycle

2021-09-15T07:50:27+00:00

[ Upstream commit 9372a82892c2caa6bccab9a4081166fa769699f8 ]

Currently allocation and registration of s390dbf debug areas are tied
together. As a result, a debug area cannot be unregistered and
re-registered while any process has an associated debugfs file open.

Fix this by splitting alloc/release from register/unregister.

Signed-off-by: Peter Oberparleiter 
Signed-off-by: Heiko Carstens 
Signed-off-by: Sasha Levin

s390/debug: keep debug data on resize

2021-09-15T07:50:27+00:00

[ Upstream commit 1204777867e8486a88dbb4793fe256b31ea05eeb ]

Any previously recorded s390dbf debug data is reset when a debug area
is resized using the 'pages' sysfs attribute. This can make
live-debugging unnecessarily complex.

Fix this by copying existing debug data to the newly allocated debug
area when resizing.

Signed-off-by: Peter Oberparleiter 
Signed-off-by: Heiko Carstens 
Signed-off-by: Sasha Levin

s390/debug: debug feature version 3

2020-08-11T16:16:43+00:00

Change __debug_entry structure in the following way:
 - remove redundant union
 - Field containing cpuid is expanded to 16 bits. 8-bit width was not
   enough since we already support up to 512 cpus.
 - Field containing the timestamp is expanded to 60 bits. The timestamp
   itself is now stored in the absolute Unix time format in microseconds
   taking the Epoch Index into acount.
Adjust default header for debug entries by setting minimum width for cpuid
to 4 digits.

Reviewed-by: Heiko Carstens 
Signed-off-by: Mikhail Zaslonko 
Signed-off-by: Heiko Carstens

s390/debug: remove raw view

2020-06-29T14:32:20+00:00

There is not a single user of the debug raw view. Therefore remove it
before anybody uses it. If anybody would make use of the view it would
expose the struct __debug_entry definition to userspace and really
would make it uapi. This wouldn't be good, since the definition is
suboptimal and needs to be changed.

Right now the structure definition is only defined to be uapi, however
there is no user.

Signed-off-by: Heiko Carstens

s390/debug: avoid kernel warning on too large number of pages

2020-06-23T12:05:55+00:00

When specifying insanely large debug buffers a kernel warning is
printed. The debug code does handle the error gracefully, though.
Instead of duplicating the check let us silence the warning to
avoid crashes when panic_on_warn is used.

Signed-off-by: Christian Borntraeger 
Reviewed-by: Heiko Carstens 
Signed-off-by: Heiko Carstens

sysctl: pass kernel pointers to ->proc_handler

2020-04-27T06:07:40+00:00

Instead of having all the sysctl handlers deal with user pointers, which
is rather hairy in terms of the BPF interaction, copy the input to and
from  userspace in common code.  This also means that the strings are
always NUL-terminated by the common code, making the API a little bit
safer.

As most handler just pass through the data to one of the common handlers
a lot of the changes are mechnical.

Signed-off-by: Christoph Hellwig 
Acked-by: Andrey Ignatov 
Signed-off-by: Al Viro

docs: s390: unify and update s390dbf kdocs at debug.c

2019-07-05T11:42:22+00:00

For non-static-inlines, debug.c already had non-compliant function
header docs. So move the pure prototype kdocs of
("s390: include/asm/debug.h add kerneldoc markups")
from debug.h to debug.c and merge them with the old function docs.
Also, I had the impression that kdoc typically is at the implementation
in the compile unit rather than at the prototype in the header file.

While at it, update the short kdoc description to distinguish the
different functions. And a few more consistency cleanups.

Added a new kdoc for debug_set_critical() since debug.h comments it
as part of the API.

Signed-off-by: Steffen Maier 
Acked-by: Christian Borntraeger 
Message-Id: <1562149189-1417-3-git-send-email-maier@linux.ibm.com>
Signed-off-by: Vasily Gorbik

s390: no need to check return value of debugfs_create functions

2019-01-28T14:58:55+00:00

When calling debugfs functions, there is no need to ever check the
return value.  The function can work or not, but the code logic should
never do something different based on this.

Cc: Martin Schwidefsky 
Cc: Heiko Carstens 
Cc: Kees Cook 
Cc: Christian Borntraeger 
Cc: Hendrik Brueckner 
Cc: linux-s390@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Heiko Carstens 
Signed-off-by: Martin Schwidefsky