Re: [PATCH v2 06/13] s390/cmf: Use kmalloc() for the CMB area

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kmalloc() does not guarantee the 32-byte alignment required by the measurement block hardware for non-power-of-two sizes.
--

commit d40fffe39ac5da27ae9d3ccc129516e13b780620
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

s390/cmf: Use kmalloc() for the CMB area

This commit replaces the use of __get_free_pages() with kmalloc() for
allocating the channel measurement block (CMB) area. It suggests that
kmalloc() naturally provides the required 32-byte alignment without
rounding up to a power-of-two number of pages.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
> index 92ab3d546fe47..8fd41a7dfc20b 100644
> --- a/drivers/s390/cio/cmf.c
> +++ b/drivers/s390/cio/cmf.c
> @@ -501,12 +504,12 @@ static int alloc_cmb(struct ccw_device *cdev)
>  		WARN_ON(!list_empty(&cmb_area.list));
>  
>  		spin_unlock(&cmb_area.lock);
> -		mem = (void *)__get_free_pages(GFP_KERNEL, get_order(size));
> +		mem = kmalloc(size, GFP_KERNEL);

[Severity: High]
Does kmalloc() guarantee the strict 32-byte alignment required by the schm
instruction when slab debugging or KASAN is enabled?

If the maxchannels module parameter is set to a value resulting in a
non-power-of-two multiple of 32 (for example, 3 channels which is 96 bytes),
the allocation uses the kmalloc-96 slab cache. While 96-byte pacing might
naturally align to 32 bytes in a default configuration, enabling
CONFIG_SLUB_DEBUG or CONFIG_KASAN adds left redzones to the objects.

This shifts the returned memory pointer, breaking the 32-byte alignment.
When cmf_activate() uses this pointer for the schm instruction, it will
cause a hardware fault and a kernel panic (Specification Exception) because
the measurement block origin is not on a 32-byte boundary.

The previous __get_free_pages() implementation avoided this by unconditionally
providing page-aligned memory.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910-s390-cio-ready-v2-0-e931086fdde1@kernel.org?part=6