Re: [PATCH v2 2/3] serial: core: replace get_zeroed_page() with kzalloc()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Replacing get_zeroed_page() with kzalloc(PAGE_SIZE) drops the page-alignment guarantee, breaking UART drivers that map xmit_buf for DMA.
--

commit 1bc591e29475edce55380edd521d83cecd0b99ca
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

serial: core: replace get_zeroed_page() with kzalloc()

This commit replaces the buddy allocator get_zeroed_page() with
kzalloc(PAGE_SIZE) for allocating the serial port transmit buffer. It also
updates the variable type from unsigned long to a pointer to avoid casts.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index 95774b0f1484b..a72fe14f76771 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
[ ... ]
> @@ -247,29 +247,29 @@ static int uart_alloc_xmit_buf(struct tty_port *port)
>  	struct uart_state *state = container_of(port, struct uart_state, port);
>  	struct uart_port *uport;
>  	unsigned long flags;
> -	unsigned long page;
> +	u8 *buf;
>  
>  	/*
>  	 * Initialise and allocate the transmit and temporary
>  	 * buffer.
>  	 */
> -	page = get_zeroed_page(GFP_KERNEL);
> -	if (!page)
> +	buf = kzalloc(PAGE_SIZE, GFP_KERNEL);

[Severity: Critical]
Will this alignment change break UART drivers that map xmit_buf for DMA?

When SLUB debugging (redzoning) or KASAN is enabled, kzalloc(PAGE_SIZE)
returns a buffer that is offset by metadata and no longer page-aligned.
Several drivers appear to rely on the page alignment guarantee of
get_zeroed_page().

For example, atmel_prepare_tx_dma() explicitly asserts page alignment and
will panic:

drivers/tty/serial/atmel_serial.c:atmel_prepare_tx_dma() {
        ...
        BUG_ON(!PAGE_ALIGNED(tport->xmit_buf));
        ...
}

Additionally, dma_handle_tx() in pch_uart.c assumes page alignment during
the DMA scatterlist mapping and address calculation:

drivers/tty/serial/pch_uart.c:dma_handle_tx() {
        ...
        sg_set_page(sg, virt_to_page(tport->xmit_buf),
                    rem, fifo_size * i);
        ...
        sg_dma_address(sg) = (sg_dma_address(sg) & ~(UART_XMIT_SIZE - 1)) +
                             sg->offset;
        ...
}

Because the sub-page offset of an unaligned xmit_buf is not provided to
sg_set_page(), does this cause the DMA controller to read from the page
boundary instead of the actual buffer? This could result in transmitting
SLUB metadata or adjacent kernel objects over the serial port instead of
the intended data.

> +	if (!buf)
>  		return -ENOMEM;
>  
>  	uport = uart_port_ref_lock(state, &flags);
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-tty-v2-0-88cd58c3c640@kernel.org?part=2