Re: [PATCH v3 01/13] s390/chsc: Use kzalloc() for CUBs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] s390/cio: kzalloc() breaks strict 4K page-alignment for CUB/ECUB DMA
--

commit 6b733741b98fcfa57ed4ac8655c793a212c8f4aa
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>
s390/chsc: Use kzalloc() for CUBs

This commit replaces the use of get_zeroed_page() with kzalloc() and
free_page() with kfree() for allocating and freeing channel measurement unit
blocks (CUBs) and extended CUBs.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
> index 9689f722c863c..60a4a7e6086ce 100644
> --- a/drivers/s390/cio/chsc.c
> +++ b/drivers/s390/cio/chsc.c
> @@ -931,12 +931,12 @@ static int cub_alloc(struct channel_subsystem *css)
>  	int i;
>  
>  	for (i = 0; i < CSS_NUM_CUB_PAGES; i++) {
> -		css->cub[i] = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
> +		css->cub[i] = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);

[Severity: High]
Is it safe to use kzalloc() here when the s390 hardware strictly expects
4K-aligned page addresses for Channel Measurement Blocks?

When SLUB debugging or KASAN is enabled, kzalloc() can return a pointer that
is shifted away from the 4K page boundary due to padding and redzones. Since
__chsc_do_secm() passes these pointers to hardware which truncates the lower
12 bits:

drivers/s390/cio/chsc.c:__chsc_do_secm() {
    ...
    secm_area->cub[i] = (__force dma64_t)virt_to_dma32(css->cub[i]);
    ...
}

Would this cause the hardware to DMA write to the start of the slab page,
potentially overwriting SLUB metadata or adjacent objects when channel
measurement is enabled?

>  		if (!css->cub[i])
>  			return -ENOMEM;
>  	}
>  	for (i = 0; i < CSS_NUM_ECUB_PAGES; i++) {
> -		css->ecub[i] = (void *)get_zeroed_page(GFP_KERNEL);
> +		css->ecub[i] = kzalloc(PAGE_SIZE, GFP_KERNEL);

[Severity: High]
Does this allocation have the same 4K alignment requirement as CUB pages
above, and could it cause the same DMA memory corruption if the pointer is
not page-aligned?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916-s390-cio-ready-v3-0-39e4894637d6@kernel.org?part=1