[PATCH v2] s390/debug: Fix NULL pointer dereference in debug_info_copy()

[Mikhail Zaslonko <zaslonko@linux.ibm.com>]

When debug_register_static() fails, it clears areas, active_pages and
active_entries but leaves the area bounds unchanged. Copying such an
area, either by opening its view file or via debug_dump(), makes
debug_info_copy() dereference the NULL pointers.

Skip the copy loop when the source has no areas.

Closes: https://lore.kernel.org/r/20260903132123.12F271F00A3F@smtp.kernel.org
Fixes: d72541f94512 ("s390/debug: add early tracing support")
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
---
v2:
- Different approach: check the areas pointer in debug_info_copy()
  instead of zeroing nr_areas/pages_per_area in debug_register_static().
  Zeroing nr_areas made debug_info_alloc() return ZERO_SIZE_PTR for
  active_pages/active_entries, which debug_to_act_entry() dereferences
  before debug_prev_entry() checks id->areas.
  Checking the pointer also matches what all other readers in this file
  already do.
- v1: https://lore.kernel.org/all/20260910104525.3788362-1-zaslonko@linux.ibm.com/

 arch/s390/kernel/debug.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index b5bf8284dbfc..d611d0eed1f6 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -434,7 +434,8 @@ static debug_info_t *debug_info_copy(debug_info_t *in, int mode)
 		debug_info_free(rc);
 	} while (1);
 
-	if (mode == NO_AREAS)
+	/* debug_register_static() failure leaves areas NULL, bounds intact */
+	if (mode == NO_AREAS || !in->areas)
 		goto out;
 
 	for (i = 0; i < in->nr_areas; i++) {
-- 
2.55.0