Re: [PATCH 13/13] s390/scm: Use kmalloc() for SCM information

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Replacing `__get_free_page()` with `kmalloc(PAGE_SIZE)` breaks the strict 4K page-alignment requirement of the CHSC instruction when SLUB debugging is enabled.
--

commit ad79881d62e47e7d8ac373d9ac1ace6a762ae9a4
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

s390/scm: Use kmalloc() for SCM information

This commit replaces the allocation of the CHSC Store SCM Information command
response buffer from __get_free_page() to kmalloc(). It also updates the
local response buffer to use the __free(kfree) scope-based cleanup helper.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/s390/cio/scm.c b/drivers/s390/cio/scm.c
> index 171212a6d2d9c..b79fe023ab8d1 100644
> --- a/drivers/s390/cio/scm.c
> +++ b/drivers/s390/cio/scm.c
[ ... ]
> @@ -224,12 +225,12 @@ static int scm_add(struct chsc_scm_info *scm_info, size_t num)
>  
>  int scm_update_information(void)
>  {
> -	struct chsc_scm_info *scm_info;
> +	struct chsc_scm_info *scm_info __free(kfree) = NULL;
>  	u64 token = 0;
>  	size_t num;
>  	int ret;
>  
> -	scm_info = (void *)__get_free_page(GFP_KERNEL | GFP_DMA);
> +	scm_info = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);

[Severity: High]
Does this change break the 4K page-alignment requirement for the CHSC
instruction?

In drivers/s390/cio/scm.c:scm_update_information(), replacing the natively
page-aligned __get_free_page() with kmalloc(PAGE_SIZE) means the returned
pointer can be unaligned when SLUB debugging or KASAN is enabled, due to
padding added before the object.

This scm_info pointer is passed down and ultimately used by the CHSC
instruction in drivers/s390/cio/ioasm.c:chsc(). The s390 architecture
strictly mandates that CHSC command blocks be placed on a 4K-byte boundary.

Executing the instruction with an unaligned address triggers a hardware
Specification Exception kernel crash.

>  	if (!scm_info)
>  		return -ENOMEM;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907-s390-cio-ready-v1-0-ca7f39806234@kernel.org?part=13