]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
s390/debug: Reject zero-length input before trimming a newline
authorPengpeng Hou <pengpeng@iscas.ac.cn>
Fri, 17 Apr 2026 07:35:30 +0000 (15:35 +0800)
committerAlexander Gordeev <agordeev@linux.ibm.com>
Tue, 28 Apr 2026 12:45:02 +0000 (14:45 +0200)
commitc366a7b5ed7564e41345c380285bd3f6cb98971b
tree9f97460f0efec45f65ecec0ee07056aaed3d417e
parent254f49634ee16a731174d2ae34bc50bd5f45e731
s390/debug: Reject zero-length input before trimming a newline

debug_get_user_string() duplicates the userspace buffer with
memdup_user_nul() and then unconditionally looks at buffer[user_len - 1]
to strip a trailing newline.

A zero-length write reaches this helper unchanged, so the newline trim
reads before the start of the allocated buffer.

Reject empty writes before accessing the last input byte.

Fixes: 66a464dbc8e0 ("[PATCH] s390: debug feature changes")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Tested-by: Vasily Gorbik <gor@linux.ibm.com>
Link: https://lore.kernel.org/r/20260417073530.96002-1-pengpeng@iscas.ac.cn
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
arch/s390/kernel/debug.c