From 95cfa75e6c4e0acbd0075f20474020a37785bd03 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Thu, 21 May 2026 10:28:34 +0800 Subject: [PATCH] s390/debug: Reject zero-length input before trimming a newline ANBZ: #38645 commit a052c2d8399a6fcffdef59aca13ecb5bf48e3bec stable. commit c366a7b5ed7564e41345c380285bd3f6cb98971b upstream. debug_get_user_string() copies the userspace buffer into a newly allocated NUL-terminated buffer and then unconditionally looks at buffer[user_len - 1] to strip a trailing newline. A zero-length write reaches this helper unchanged, so the newline trim reads before the start of the allocated buffer. Reject empty writes before accessing the last input byte. Fixes: 66a464dbc8e0 ("[PATCH] s390: debug feature changes") Cc: stable@vger.kernel.org Signed-off-by: Pengpeng Hou Reviewed-by: Benjamin Block Reviewed-by: Vasily Gorbik Tested-by: Vasily Gorbik Link: https://lore.kernel.org/r/20260417073530.96002-1-pengpeng@iscas.ac.cn Signed-off-by: Vasily Gorbik Signed-off-by: Alexander Gordeev Signed-off-by: Sasha Levin Assisted-by: PatchPilot Signed-off-by: Dust Li --- arch/s390/kernel/debug.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c index cbe209fe0df1..893c35aeb746 100644 --- a/arch/s390/kernel/debug.c +++ b/arch/s390/kernel/debug.c @@ -1258,6 +1258,9 @@ static inline char *debug_get_user_string(const char __user *user_buf, { char *buffer; + if (!user_len) + return ERR_PTR(-EINVAL); + buffer = kmalloc(user_len + 1, GFP_KERNEL); if (!buffer) return ERR_PTR(-ENOMEM); -- Gitee