Re: [PATCH 06/13] s390/cmf: Use kmalloc() for the CMB area

[Mike Rapoport <rppt@kernel.org>]

On Mon, Sep 07, 2026 at 10:35:39AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] Integer overflow to zero-size allocation causing lowcore memory corruption.
> --
> 
> commit 2913241109f97628467377f13982dfc657e8d846
> Author: Mike Rapoport (Microsoft) <rppt@kernel.org>
> 
> s390/cmf: Use kmalloc() for the CMB area
> 
> This commit replaces __get_free_pages() with kmalloc() for allocating
> the channel measurement block area, and updates the free path to use
> kfree().
> 
> Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
> 
> > diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
> > index 92ab3d546fe47..6c46b0d0b3da4 100644
> > --- a/drivers/s390/cio/cmf.c
> > +++ b/drivers/s390/cio/cmf.c
> > @@ -501,12 +501,12 @@ static int alloc_cmb(struct ccw_device *cdev)
> >  		WARN_ON(!list_empty(&cmb_area.list));
> >  
> >  		spin_unlock(&cmb_area.lock);
> > -		mem = (void *)__get_free_pages(GFP_KERNEL, get_order(size));
> > +		mem = kmalloc(PAGE_SIZE << get_order(size), GFP_KERNEL);
> 
> [Severity: Critical]
> If size evaluates to 0 (for example, if the maxchannels module parameter
> is configured to 0 by the user), get_order(0) underflows and returns 52 on
> 64-bit s390x.

I missed that one while reviewing automated conversion. It should be

	mem = kmalloc(PAGE_ALIGN(size), GFP_KERNEL);
 
> The allocation size expression PAGE_SIZE << 52 evaluates to
> (1UL << 12) << 52, which wraps around modulo 64 and evaluates to exactly 0.

-- 
Sincerely yours,
Mike.