Re: [PATCH v3 03/13] s390/chsc_sch: Use kzalloc() for CHSC requests

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] s390/cio: kzalloc() breaks 4KB hardware alignment required by chsc instruction
--

commit 54194635e9207f1ada1f8c978b8a14c7a6ba3fc7
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>
s390/chsc_sch: Use kzalloc() for CHSC requests

This commit replaces the use of get_zeroed_page() with kzalloc() and 
free_page() with kfree() for allocating and freeing CHSC request and 
response areas across several ioctl handlers.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
> index b6cb8bb8bcc4b..c8d6871d1841e 100644
> --- a/drivers/s390/cio/chsc_sch.c
> +++ b/drivers/s390/cio/chsc_sch.c
> @@ -292,7 +292,7 @@ static int chsc_ioctl_start(void __user *user_area)
>  	if (!css_general_characteristics.dynio)
>  		/* It makes no sense to try. */
>  		return -EOPNOTSUPP;
> -	chsc_area = (void *)get_zeroed_page(GFP_DMA | GFP_KERNEL);
> +	chsc_area = kzalloc(PAGE_SIZE, GFP_DMA | GFP_KERNEL);

[Severity: High]
Does changing this allocation to kzalloc() break the 4KB hardware page
alignment required by the chsc instruction?

When debugging options like slub debug redzones or kasan are enabled, using
kzalloc() for a page-sized allocation does not guarantee that the returned
pointer is page-aligned. Since the chsc hardware instruction requires the 
command block operand to reside strictly on a 4KB boundary, passing an 
unaligned pointer can result in a specification exception 
(Program Interrupt 0x06) and an immediate kernel panic.

[ ... ]

> @@ -392,7 +392,7 @@ static int chsc_ioctl_start_sync(void __user *user_area)
>  	struct chsc_sync_area *chsc_area;
>  	int ret, ccode;
>  
> -	chsc_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
> +	chsc_area = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);

[Severity: High]
This appears to be another instance where dynamically allocated memory might
not be page-aligned. Could this unaligned pointer also be passed directly to
the chsc() hardware instruction later in this function, triggering the same
specification exception?

[ ... ]

> @@ -438,7 +438,7 @@ static int chsc_ioctl_info_channel_path(void __user *user_cd)
>  		u8 data[PAGE_SIZE - 20];
>  	} __attribute__ ((packed)) *scpcd_area;
>  
> -	scpcd_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
> +	scpcd_area = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);

[Severity: High]
This looks like it matches the same allocation pattern for the channel path
description command block. Will this also lead to an unaligned pointer
being passed to chsc()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916-s390-cio-ready-v3-0-39e4894637d6@kernel.org?part=3