Re: [PATCH v3 06/13] s390/cmf: Use kmalloc() for the CMB area

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] s390/cio: hardware alignment violation in alloc_cmb() due to kmalloc()
--

commit 8f39fa3622bcd7032d06a1645dbaec85cdb07a1f
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

s390/cmf: Use kmalloc() for the CMB area

alloc_cmb() allocates the channel measurement block area shared by
devices using the basic channel measurement format. This commit replaces
__get_free_pages() with kmalloc() and free_pages() with kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
> index 92ab3d546fe47..8fd41a7dfc20b 100644
> --- a/drivers/s390/cio/cmf.c
> +++ b/drivers/s390/cio/cmf.c
[ ... ]
> @@ -501,12 +504,12 @@ static int alloc_cmb(struct ccw_device *cdev)
>  		WARN_ON(!list_empty(&cmb_area.list));
>  
>  		spin_unlock(&cmb_area.lock);
> -		mem = (void *)__get_free_pages(GFP_KERNEL, get_order(size));
> +		mem = kmalloc(size, GFP_KERNEL);

[Severity: High]
Does this allocation still guarantee the 32-byte alignment required by the
hardware for the measurement block origin (MBO)?

While kmalloc() naturally aligns power-of-two multiples in default
configurations, if memory debugging options like CONFIG_SLUB_DEBUG
(redzoning) or CONFIG_KASAN are enabled, SLUB can insert metadata padding
before the object payload.

This padding shifts the returned physical address so it is only guaranteed
to be aligned to ARCH_KMALLOC_MINALIGN (8 bytes on s390), potentially
breaking the 32-byte alignment requirement.

If the unaligned address is then used in cmf_activate():

drivers/s390/cio/cmf.c:cmf_activate() {
    ...
	asm volatile(
		"	lgr	1,%[r1]\n"
		"	lgr	2,%[mbo]\n"
		"	schm"
		:
		: [r1] "d" ((unsigned long)onoff),
		  [mbo] "d" (virt_to_phys(area))
		: "1", "2");
    ...
}

could this trigger a specification exception and crash the kernel when the
schm instruction executes?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916-s390-cio-ready-v3-0-39e4894637d6@kernel.org?part=6