[PATCH v2] s390/debug: Fix NULL pointer dereference in debug_info_copy()

[PATCH v2] s390/debug: Fix NULL pointer dereference in debug_info_copy()

[Mikhail Zaslonko]

When debug_register_static() fails, it clears areas, active_pages and
active_entries but leaves the area bounds unchanged. Copying such an
area, either by opening its view file or via debug_dump(), makes
debug_info_copy() dereference the NULL pointers.

Skip the copy loop when the source has no areas.

Closes: https://lore.kernel.org/r/20260903132123.12F271F00A3F@smtp.kernel.org
Fixes: d72541f94512 ("s390/debug: add early tracing support")
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
---
v2:
- Different approach: check the areas pointer in debug_info_copy()
  instead of zeroing nr_areas/pages_per_area in debug_register_static().
  Zeroing nr_areas made debug_info_alloc() return ZERO_SIZE_PTR for
  active_pages/active_entries, which debug_to_act_entry() dereferences
  before debug_prev_entry() checks id->areas.
  Checking the pointer also matches what all other readers in this file
  already do.
- v1: https://lore.kernel.org/all/20260910104525.3788362-1-zaslonko@linux.ibm.com/

 arch/s390/kernel/debug.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index b5bf8284dbfc..d611d0eed1f6 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -434,7 +434,8 @@ static debug_info_t *debug_info_copy(debug_info_t *in, int mode)
 		debug_info_free(rc);
 	} while (1);
 
-	if (mode == NO_AREAS)
+	/* debug_register_static() failure leaves areas NULL, bounds intact */
+	if (mode == NO_AREAS || !in->areas)
 		goto out;
 
 	for (i = 0; i < in->nr_areas; i++) {
-- 
2.55.0

Re: [PATCH v2] s390/debug: Fix NULL pointer dereference in debug_info_copy()

[sashiko-bot]

> When debug_register_static() fails, it clears areas, active_pages and
> active_entries but leaves the area bounds unchanged. Copying such an
> area, either by opening its view file or via debug_dump(), makes
> debug_info_copy() dereference the NULL pointers.
> 
> Skip the copy loop when the source has no areas.
> 
> Closes: https://lore.kernel.org/r/20260903132123.12F271F00A3F@smtp.kernel.org
> Fixes: d72541f94512 ("s390/debug: add early tracing support")
> Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916160626.1988684-1-zaslonko@linux.ibm.com?part=1

Re: [PATCH v2] s390/debug: Fix NULL pointer dereference in debug_info_copy()

[Heiko Carstens]

On Wed, Sep 16, 2026 at 06:06:26PM +0200, Mikhail Zaslonko wrote:
> When debug_register_static() fails, it clears areas, active_pages and
> active_entries but leaves the area bounds unchanged. Copying such an
> area, either by opening its view file or via debug_dump(), makes
> debug_info_copy() dereference the NULL pointers.
> 
> Skip the copy loop when the source has no areas.
> 
> Closes: https://lore.kernel.org/r/20260903132123.12F271F00A3F@smtp.kernel.org
> Fixes: d72541f94512 ("s390/debug: add early tracing support")
> Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
> ---
> v2:
> - Different approach: check the areas pointer in debug_info_copy()
>   instead of zeroing nr_areas/pages_per_area in debug_register_static().
>   Zeroing nr_areas made debug_info_alloc() return ZERO_SIZE_PTR for
>   active_pages/active_entries, which debug_to_act_entry() dereferences
>   before debug_prev_entry() checks id->areas.
>   Checking the pointer also matches what all other readers in this file
>   already do.
> - v1: https://lore.kernel.org/all/20260910104525.3788362-1-zaslonko@linux.ibm.com/
> 
>  arch/s390/kernel/debug.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
> index b5bf8284dbfc..d611d0eed1f6 100644
> --- a/arch/s390/kernel/debug.c
> +++ b/arch/s390/kernel/debug.c
> @@ -434,7 +434,8 @@ static debug_info_t *debug_info_copy(debug_info_t *in, int mode)
>  		debug_info_free(rc);
>  	} while (1);
>  
> -	if (mode == NO_AREAS)
> +	/* debug_register_static() failure leaves areas NULL, bounds intact */
> +	if (mode == NO_AREAS || !in->areas)

This is just a more or less random indicator that debug_register_static()
failed. But this seems to be the easiest way forward. Alternatively an
explicit flag in debug_info_t would make this more obvious.

Anyway:
Acked-by: Heiko Carstens <hca@linux.ibm.com>

Waiting for Peter's reply.

Re: [PATCH v2] s390/debug: Fix NULL pointer dereference in debug_info_copy()

[Peter Oberparleiter]

On 18.09.2026 12:44, Heiko Carstens wrote:
> On Wed, Sep 16, 2026 at 06:06:26PM +0200, Mikhail Zaslonko wrote:
>> When debug_register_static() fails, it clears areas, active_pages and
>> active_entries but leaves the area bounds unchanged. Copying such an
>> area, either by opening its view file or via debug_dump(), makes
>> debug_info_copy() dereference the NULL pointers.
>>
>> Skip the copy loop when the source has no areas.
>>
>> Closes: https://lore.kernel.org/r/20260903132123.12F271F00A3F@smtp.kernel.org
>> Fixes: d72541f94512 ("s390/debug: add early tracing support")
>> Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
>> ---
>> v2:
>> - Different approach: check the areas pointer in debug_info_copy()
>>   instead of zeroing nr_areas/pages_per_area in debug_register_static().
>>   Zeroing nr_areas made debug_info_alloc() return ZERO_SIZE_PTR for
>>   active_pages/active_entries, which debug_to_act_entry() dereferences
>>   before debug_prev_entry() checks id->areas.
>>   Checking the pointer also matches what all other readers in this file
>>   already do.
>> - v1: https://lore.kernel.org/all/20260910104525.3788362-1-zaslonko@linux.ibm.com/
>>
>>  arch/s390/kernel/debug.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
>> index b5bf8284dbfc..d611d0eed1f6 100644
>> --- a/arch/s390/kernel/debug.c
>> +++ b/arch/s390/kernel/debug.c
>> @@ -434,7 +434,8 @@ static debug_info_t *debug_info_copy(debug_info_t *in, int mode)
>>  		debug_info_free(rc);
>>  	} while (1);
>>  
>> -	if (mode == NO_AREAS)
>> +	/* debug_register_static() failure leaves areas NULL, bounds intact */
>> +	if (mode == NO_AREAS || !in->areas)
> 
> This is just a more or less random indicator that debug_register_static()
> failed. But this seems to be the easiest way forward. Alternatively an
> explicit flag in debug_info_t would make this more obvious.
> 
> Anyway:
> Acked-by: Heiko Carstens <hca@linux.ibm.com>
> 
> Waiting for Peter's reply.

As Heiko mentioned, this can be done in a number of ways, but this one
is fine from my perspective.

Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>


-- 
Peter Oberparleiter
Linux on IBM Z Development - IBM Germany R&D

Re: [PATCH v2] s390/debug: Fix NULL pointer dereference in debug_info_copy()

[Heiko Carstens]

On Wed, Sep 16, 2026 at 06:06:26PM +0200, Mikhail Zaslonko wrote:
> When debug_register_static() fails, it clears areas, active_pages and
> active_entries but leaves the area bounds unchanged. Copying such an
> area, either by opening its view file or via debug_dump(), makes
> debug_info_copy() dereference the NULL pointers.
> 
> Skip the copy loop when the source has no areas.
> 
> Closes: https://lore.kernel.org/r/20260903132123.12F271F00A3F@smtp.kernel.org
> Fixes: d72541f94512 ("s390/debug: add early tracing support")
> Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
> ---
> v2:
> - Different approach: check the areas pointer in debug_info_copy()
>   instead of zeroing nr_areas/pages_per_area in debug_register_static().
>   Zeroing nr_areas made debug_info_alloc() return ZERO_SIZE_PTR for
>   active_pages/active_entries, which debug_to_act_entry() dereferences
>   before debug_prev_entry() checks id->areas.
>   Checking the pointer also matches what all other readers in this file
>   already do.
> - v1: https://lore.kernel.org/all/20260910104525.3788362-1-zaslonko@linux.ibm.com/
> 
>  arch/s390/kernel/debug.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Applied, thanks!