Files
linux/arch/s390/kernel
Vasily Gorbik e14622a758 s390/debug: Reject zero-length input in debug_input_flush_fn()
debug_input_flush_fn() always copies one byte from the userspace buffer
with copy_from_user() regardless of the supplied write length. A
zero-length write therefore reads one byte beyond the caller's buffer.
If the stale byte happens to be '-' or a digit the debug log is
silently flushed. With an unmapped buffer the call returns -EFAULT.

Reject zero-length writes before copying from userspace.

Cc: stable@vger.kernel.org # v5.10+
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-04-28 14:45:02 +02:00
..
2025-11-17 11:10:38 +01:00
2026-03-03 08:35:07 -08:00
2025-11-24 11:45:21 +01:00
2025-11-24 11:45:21 +01:00
2025-11-24 11:45:21 +01:00
2023-07-27 13:11:35 +02:00
2026-02-25 16:46:07 +01:00
2025-11-25 15:28:07 +01:00
2026-02-25 16:46:07 +01:00
2025-11-24 11:45:21 +01:00
2025-11-24 11:45:21 +01:00
2025-11-17 11:10:38 +01:00
2025-11-17 11:10:38 +01:00
2025-11-24 11:45:21 +01:00
2025-11-25 15:28:07 +01:00
2025-11-06 14:17:27 +01:00
2025-11-24 11:45:21 +01:00
2025-11-24 11:45:21 +01:00
2025-11-17 11:10:38 +01:00
2026-02-04 17:00:10 +01:00