Re: [PATCH net] s390/ism: folio_put() after error

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing __GFP_ZERO in folio_alloc() causes uninitialized kernel memory to be exposed in the receive message buffer.
--

commit d942ada155dde57df3b8bd6857db438603cbd218
Author: Alexandra Winter <wintera@linux.ibm.com>

s390/ism: folio_put() after error

This commit uses folio_put() instead of kfree() in the error path of
ism_alloc_dmb() to prevent slab allocator corruption. It also sets
dmb->cpu_addr to NULL after freeing to prevent a potential use-after-free.

Fixes: 83781384a96b ("s390/ism: Properly fix receive message buffer allocation")

> diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
> index 242da20f27e0e..035b233abb4e9 100644
> --- a/drivers/s390/net/ism_drv.c
> +++ b/drivers/s390/net/ism_drv.c
[ ... ]
> @@ -274,7 +275,8 @@ static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)
>  	return 0;
>  
>  out_free:
> -	kfree(dmb->cpu_addr);
> +	folio_put(folio);

[Severity: Critical]
This isn't a bug introduced by this patch, but the previous replacement
of dma_alloc_coherent() with folio_alloc() removed the implicit
zero-initialization of the Direct Message Buffer (DMB).

Looking at the allocation earlier in ism_alloc_dmb():

drivers/s390/net/ism_drv.c:ism_alloc_dmb() {
        ...
        folio = folio_alloc(GFP_KERNEL | __GFP_NOWARN | __GFP_NOMEMALLOC |
                            __GFP_NORETRY, get_order(dmb->dmb_len));
        ...
}

Does this missing __GFP_ZERO leak uninitialized host kernel memory to an
untrusted remote peer?

A remote, unprivileged peer partition can trigger an SMC connection
establishment via smcd_new_buf_create() -> smc_ism_register_dmb(). This
causes the local host to allocate and map the DMB memory without
zero-filling it locally before the peer partition gains access to it,
potentially exposing uninitialized memory across the virtual machine or
LPAR boundary.

> +	dmb->cpu_addr = NULL;
>  out_bit:
>  	clear_bit(dmb->idx, ism->sba_bitmap);
>  	return rc;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902143733.433574-1-wintera@linux.ibm.com?part=1