Re: [PATCH] s390/traps: Add exception statistics

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Reading the `/sys/kernel/debug/s390/exceptions` file causes a guaranteed kernel panic because the iterator `v` is dereferenced despite being `SEQ_START_TOKEN` (`(void *)1`).
--

commit ceb79d6258f172b6199fd66640ff5b739564b3ed
Author: Sven Schnelle <svens@linux.ibm.com>
s390/traps: Add exception statistics

This commit adds a new debugfs file at /sys/kernel/debug/s390/exceptions.
The file displays the number of program check exceptions per CPU for
debugging purposes.

> diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
> index 564403496a7ce..3de5c35be2f6f 100644
> --- a/arch/s390/kernel/traps.c
> +++ b/arch/s390/kernel/traps.c

[ ... ]

> @@ -393,6 +405,36 @@ void noinstr __do_pgm_check(struct pt_regs *regs)
>  	percpu_exit(regs, percpu_needs_fixup);
>  }
>  
> +static int pgm_check_stat_show(struct seq_file *p, void *v)
> +{
> +	int cpu, i = *(loff_t *)v;

[Severity: High]
Will reading this debugfs file cause a kernel panic?

Since DEFINE_SHOW_ATTRIBUTE(pgm_check_stat) is used below, the file operations
are created using single_open(). The show callback for single_open() seq_files
is always passed SEQ_START_TOKEN (defined as ((void *)1)) as its iterator
argument v.

Dereferencing v here via *(loff_t *)v will attempt to read from memory address
0x1, which would result in an unhandled page fault and kernel panic.

> +
> +	cpus_read_lock();
> +	if (i == 0) {
> +		seq_puts(p, "          ");
> +		for_each_online_cpu(cpu)
> +			seq_printf(p, "CPU%-8d", cpu);
> +		seq_putc(p, '\n');
> +	}
> +	for (i = 0; i < 128; i++) {
> +		seq_printf(p, "%02x: ", i);
> +		for_each_online_cpu(cpu)
> +			seq_printf(p, "%10u ", per_cpu(pgm_stat, cpu).count[i]);
> +		seq_putc(p, '\n');
> +	}
> +	cpus_read_unlock();
> +	return 0;
> +}
> +
> +DEFINE_SHOW_ATTRIBUTE(pgm_check_stat);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617113726.2079324-1-hca@linux.ibm.com?part=1