Re: [PATCH 08/32] s390/dis: Improve show_code() output

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] s390/dis: NULL pointer dereference in get_trap_ip() during early boot crashes
--

commit 200c2c0f6eaf1b7f28478fbaa164025c7b6d456e
Author: Heiko Carstens <hca@linux.ibm.com>
Subject: s390/dis: Improve show_code() output

This patch improves the disassembler output by using explicit markers
for the PSW address and the faulting instruction. It also introduces the
PIF_PGM_CHECK flag to indicate when the context is a program check.

> diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
> --- a/arch/s390/kernel/dis.c
> +++ b/arch/s390/kernel/dis.c
> @@ -511,6 +512,9 @@ void show_code(struct pt_regs *regs)
>  	pswaddr = regs->psw.addr;
>  	if (test_pt_regs_flag(regs, PIF_PSW_ADDR_ADJUSTED))
>  		pswaddr = __forward_psw(regs->psw, regs->int_code >> 16);
> +	pgm_check = test_pt_regs_flag(regs, PIF_PGM_CHECK);
> +	if (pgm_check)
> +		trapaddr = get_trap_ip(regs);

[Severity: Medium]
Could this call to get_trap_ip() cause a NULL pointer dereference during an
early boot crash?

If an early boot exception occurs with the transaction abort bit set
(regs->int_code & 0x200), __do_early_pgm_check() will handle the exception,
set PIF_PGM_CHECK, and eventually call show_regs() which calls show_code().

In get_trap_ip(), there is a check for the transaction abort bit:

arch/s390/kernel/traps.c:get_trap_ip() {
    ...
    if (regs->int_code & 0x200)
        psw.addr = current->thread.trap_tdb.data[3];
    ...
}

Since the current task pointer in the lowcore is not initialized during early
boot (before setup_arch() completes), dereferencing current here would result
in a nested panic or double fault.

Would this obscure the original crash details and cause the stack trace and
disassembly to be lost?

[ ... ]

> diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
> --- a/arch/s390/kernel/early.c
> +++ b/arch/s390/kernel/early.c
> @@ -159,6 +159,7 @@ void __init __do_early_pgm_check(struct pt_regs *regs)
>  	regs->int_parm_long = lc->trans_exc_code;
>  	regs->last_break = lc->pgm_last_break;
>  	regs->monitor_code = lc->monitor_code;
> +	set_pt_regs_flag(regs, PIF_PGM_CHECK);

[Severity: Medium]
Setting this flag here is what enables the problematic code path in
show_code() during early boot.

Does there need to be an additional check before calling get_trap_ip() or
dereferencing current, to ensure the system is fully initialized?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001103247.1989111-1-hca@linux.ibm.com?part=8