From: Vasily Gorbik <gor@linux.ibm.com>
To: Pengpeng Hou <pengpeng@iscas.ac.cn>
Cc: Heiko Carstens <hca@linux.ibm.com>,
Alexander Gordeev <agordeev@linux.ibm.com>,
Christian Borntraeger <borntraeger@linux.ibm.com>,
Sven Schnelle <svens@linux.ibm.com>,
Benjamin Block <bblock@linux.ibm.com>,
Thorsten Blum <thorsten.blum@linux.dev>,
Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>,
Kees Cook <kees@kernel.org>,
linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] s390/debug: reject zero-length input before trimming a newline
Date: Fri, 17 Apr 2026 15:07:37 +0200 [thread overview]
Message-ID: <ttdn34p@ub.hpns> (raw)
In-Reply-To: <20260417073530.96002-1-pengpeng@iscas.ac.cn>
On Fri, Apr 17, 2026 at 03:35:30PM +0800, Pengpeng Hou wrote:
> debug_get_user_string() duplicates the userspace buffer with
> memdup_user_nul() and then unconditionally looks at buffer[user_len - 1]
> to strip a trailing newline.
>
> A zero-length write reaches this helper unchanged, so the newline trim
> reads before the start of the allocated buffer.
>
> Reject empty writes before accessing the last input byte.
>
> Fixes: 66a464dbc8e0 ("[PATCH] s390: debug feature changes")
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> arch/s390/kernel/debug.c | 3 +++
> 1 file changed, 3 insertions(+)
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Tested-by: Vasily Gorbik <gor@linux.ibm.com>
Added
Cc: stable@vger.kernel.org
And applied, thank you!
I've also addressed Sashiko's complaint [1] about debug_input_flush_fn()
as a separate patch.
[1] https://sashiko.dev/#/patchset/20260417073530.96002-1-pengpeng%40iscas.ac.cn
prev parent reply other threads:[~2026-04-17 13:07 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-17 7:35 [PATCH] s390/debug: reject zero-length input before trimming a newline Pengpeng Hou
2026-04-17 9:41 ` Benjamin Block
2026-04-17 13:07 ` Vasily Gorbik [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ttdn34p@ub.hpns \
--to=gor@linux.ibm.com \
--cc=agordeev@linux.ibm.com \
--cc=bblock@linux.ibm.com \
--cc=borntraeger@linux.ibm.com \
--cc=hca@linux.ibm.com \
--cc=kees@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=pengpeng@iscas.ac.cn \
--cc=svens@linux.ibm.com \
--cc=thorsten.blum@linux.dev \
--cc=tigran.mkrtchyan@desy.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox