Re: [PATCH v3 05/13] s390/cio: Use kzalloc() for CHSC work areas

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] s390/cio: kzalloc() breaks CHSC hardware 4K alignment requirement
--

commit a66087fda8920c920a2e60507dcf682684ee9966
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

    s390/cio: Use kzalloc() for CHSC work areas
    
    chsc_init() allocates the work area for CHSC commands and
    qdio_allocate() allocates one for CHSC calls during qdio_establish().
    
    This memory can be allocated with kmalloc() as there's nothing special
    about it to go directly to the page allocator.

    Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
> index c3186c0a372b4..d98f629e89295 100644
> --- a/drivers/s390/cio/chsc.c
> +++ b/drivers/s390/cio/chsc.c
> @@ -1143,7 +1143,7 @@ int __init chsc_init(void)
>  	int ret;
>  
>  	sei_page = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
                   ^^^^^^^

[Severity: High]
Can this kzalloc() allocation for sei_page in chsc_init() cause a hardware
specification exception?

The s390 CHSC (Channel Subsystem Call) instruction requires its command-request
block operands to be strictly aligned on a 4K page boundary. Under kernel debug
configurations like CONFIG_SLUB_DEBUG or KASAN, kmalloc caches append redzones
and metadata, which shifts the payload offset within higher-order pages and
breaks the natural page alignment.

Since sei_page is passed to the CHSC instruction, an unaligned operand could
result in a kernel crash.

> -	chsc_page = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
> +	chsc_page = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
                    ^^^^^^^

[Severity: High]
Does replacing get_zeroed_page() with kzalloc() here similarly break the 4K
page alignment guarantee for chsc_page?

Like sei_page, the global chsc_page in drivers/s390/cio/chsc.c is used directly
as a CHSC command block and will fault if it is unaligned. By moving from
get_zeroed_page() to kzalloc(), the strict page alignment guarantee is lost on
debug kernels.

[ ... ]

> diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
> index c1e09fa34e774..d137bf8c70664 100644
> --- a/drivers/s390/cio/qdio_main.c
> +++ b/drivers/s390/cio/qdio_main.c
[ ... ]
> @@ -986,7 +986,7 @@ int qdio_allocate(struct ccw_device *cdev, unsigned int no_input_qs,
>  	 * qdio_establish. In case of low memory and swap on a zfcp disk
>  	 * we may not be able to allocate memory otherwise.
>  	 */
> -	irq_ptr->chsc_page = get_zeroed_page(GFP_KERNEL);
> +	irq_ptr->chsc_page = kzalloc(PAGE_SIZE, GFP_KERNEL);
                             ^^^^^^^

[Severity: High]
Does using kzalloc() here in qdio_allocate() break the 4K alignment
requirement for the per-irq chsc_page?

This per-irq chsc_page in drivers/s390/cio/qdio_main.c is passed to hardware
in qdio_setup_get_ssqd() and set_subchannel_ind(). If CONFIG_SLUB_DEBUG or
KASAN is enabled, the kzalloc payload may not be 4K-aligned, causing a hardware
specification exception during device setup.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916-s390-cio-ready-v3-0-39e4894637d6@kernel.org?part=5