Re: [PATCH v2] s390/debug: Fix NULL pointer dereference in debug_info_copy()

[Peter Oberparleiter <oberpar@linux.ibm.com>]

On 18.09.2026 12:44, Heiko Carstens wrote:
> On Wed, Sep 16, 2026 at 06:06:26PM +0200, Mikhail Zaslonko wrote:
>> When debug_register_static() fails, it clears areas, active_pages and
>> active_entries but leaves the area bounds unchanged. Copying such an
>> area, either by opening its view file or via debug_dump(), makes
>> debug_info_copy() dereference the NULL pointers.
>>
>> Skip the copy loop when the source has no areas.
>>
>> Closes: https://lore.kernel.org/r/20260903132123.12F271F00A3F@smtp.kernel.org
>> Fixes: d72541f94512 ("s390/debug: add early tracing support")
>> Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
>> ---
>> v2:
>> - Different approach: check the areas pointer in debug_info_copy()
>>   instead of zeroing nr_areas/pages_per_area in debug_register_static().
>>   Zeroing nr_areas made debug_info_alloc() return ZERO_SIZE_PTR for
>>   active_pages/active_entries, which debug_to_act_entry() dereferences
>>   before debug_prev_entry() checks id->areas.
>>   Checking the pointer also matches what all other readers in this file
>>   already do.
>> - v1: https://lore.kernel.org/all/20260910104525.3788362-1-zaslonko@linux.ibm.com/
>>
>>  arch/s390/kernel/debug.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
>> index b5bf8284dbfc..d611d0eed1f6 100644
>> --- a/arch/s390/kernel/debug.c
>> +++ b/arch/s390/kernel/debug.c
>> @@ -434,7 +434,8 @@ static debug_info_t *debug_info_copy(debug_info_t *in, int mode)
>>  		debug_info_free(rc);
>>  	} while (1);
>>  
>> -	if (mode == NO_AREAS)
>> +	/* debug_register_static() failure leaves areas NULL, bounds intact */
>> +	if (mode == NO_AREAS || !in->areas)
> 
> This is just a more or less random indicator that debug_register_static()
> failed. But this seems to be the easiest way forward. Alternatively an
> explicit flag in debug_info_t would make this more obvious.
> 
> Anyway:
> Acked-by: Heiko Carstens <hca@linux.ibm.com>
> 
> Waiting for Peter's reply.

As Heiko mentioned, this can be done in a number of ways, but this one
is fine from my perspective.

Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>


-- 
Peter Oberparleiter
Linux on IBM Z Development - IBM Germany R&D