linux-s390.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Mikhail Zaslonko <zaslonko@linux.ibm.com>
To: linux-s390@vger.kernel.org
Cc: Heiko Carstens <hca@linux.ibm.com>,
	Alexander Gordeev <agordeev@linux.ibm.com>,
	Vasily Gorbik <gor@linux.ibm.com>,
	Ilya Leoshkevich <iii@linux.ibm.com>,
	Peter Oberparleiter <oberpar@linux.ibm.com>
Subject: [PATCH v3 0/3] s390/debug: Fix several s390dbf issues reported by AI scan
Date: Thu,  3 Sep 2026 15:07:30 +0200	[thread overview]
Message-ID: <20260903130733.709001-1-zaslonko@linux.ibm.com> (raw)

The s390dbf kernel parameter was added in commit a2cec6863709
("s390/debug: Add s390dbf kernel parameter"). This series fixes
three issues found in the surrounding code.

Patch 1 fixes a NULL pointer dereference in debug_set_level()
introduced by that commit: the NULL check for the id argument
was moved into the _debug_set_level() helper, but the newly added
debug_get_param() call was left in the wrapper ahead of it.

Patch 2 eliminates a duplicate override notice that appears when
drivers call debug_set_level() right after debug_register(), which
is the common pattern. With the s390dbf= parameter active and
many devices (e.g. many DASDs), this produced a lot of redundant
log lines during boot.

Patch 3 fixes a pre-existing race between debug area resize and
event logging. Setting pages to zero via the debugfs interface
races with concurrent event writers: the unlocked id->areas check
passes, but by the time the lock is acquired debug_areas_swap()
may have published a NULL pointer, which get_active_entry() then
dereferences. The race was confirmed to hang the system in testing
by running concurrent debug area resize (pages 0->4 in a tight
loop) against parallel DASD I/O.

Changes in v3:
- Patch 3: put back !id->areas check under lock in debug_flush()
  and remove existing !id->areas check before the lock (Peter Oberparleiter)

Changes in v2:
- Patch 1: Trimmed commit message; !id check removed from
  _debug_set_level() (Peter Oberparleiter)
- Patch 3: Trimmed commit message; !id->areas check removed
  from debug_flush() (Peter Oberparleiter)

Mikhail Zaslonko (3):
  s390/debug: Fix NULL pointer dereference in debug_set_level()
  s390/debug: Do not repeat parameter override notice on
    debug_set_level()
  s390/debug: Fix race between debug area resize and event logging

 arch/s390/kernel/debug.c | 54 ++++++++++++++++++++++++++--------------
 1 file changed, 36 insertions(+), 18 deletions(-)

-- 
2.55.0


             reply	other threads:[~2026-09-03 13:07 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-03 13:07 Mikhail Zaslonko [this message]
2026-09-03 13:07 ` [PATCH v3 1/3] s390/debug: Fix NULL pointer dereference in debug_set_level() Mikhail Zaslonko
2026-09-03 13:16   ` sashiko-bot
2026-09-03 13:07 ` [PATCH v3 2/3] s390/debug: Do not repeat parameter override notice on debug_set_level() Mikhail Zaslonko
2026-09-03 13:17   ` sashiko-bot
2026-09-03 13:07 ` [PATCH v3 3/3] s390/debug: Fix race between debug area resize and event logging Mikhail Zaslonko
2026-09-03 13:21   ` sashiko-bot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260903130733.709001-1-zaslonko@linux.ibm.com \
    --to=zaslonko@linux.ibm.com \
    --cc=agordeev@linux.ibm.com \
    --cc=gor@linux.ibm.com \
    --cc=hca@linux.ibm.com \
    --cc=iii@linux.ibm.com \
    --cc=linux-s390@vger.kernel.org \
    --cc=oberpar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).