]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
s390/debug: Reject zero-length input in debug_input_flush_fn()
authorVasily Gorbik <gor@linux.ibm.com>
Fri, 17 Apr 2026 12:33:43 +0000 (14:33 +0200)
committerAlexander Gordeev <agordeev@linux.ibm.com>
Tue, 28 Apr 2026 12:45:02 +0000 (14:45 +0200)
commite14622a7584f9608927c59a7d6ae4a0999dc545e
tree88e1b377ef7b563aaff15d539458d9de376b6363
parentc366a7b5ed7564e41345c380285bd3f6cb98971b
s390/debug: Reject zero-length input in debug_input_flush_fn()

debug_input_flush_fn() always copies one byte from the userspace buffer
with copy_from_user() regardless of the supplied write length. A
zero-length write therefore reads one byte beyond the caller's buffer.
If the stale byte happens to be '-' or a digit the debug log is
silently flushed. With an unmapped buffer the call returns -EFAULT.

Reject zero-length writes before copying from userspace.

Cc: stable@vger.kernel.org # v5.10+
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
arch/s390/kernel/debug.c