Re: [PATCH 5/5] s390/hmcdrv: Replace page allocator calls with k[mz]alloc()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] s390/hmcdrv: zero-length requests rejected with -ENOMEM in
  hmcdrv_ftp_cmd()
--

commit 64ed22d8db2caf381431154b54f669d68274ef30
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

s390/hmcdrv: Replace page allocator calls with k[mz]alloc()

This commit replaces get_zeroed_page(), __get_free_pages(), and
free_page[s]() in the s390 hmcdrv driver with kzalloc(), kmalloc(), and
kfree(), rounding buffer sizes up to PAGE_SIZE.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/s390/char/hmcdrv_ftp.c b/drivers/s390/char/hmcdrv_ftp.c
> index 3312b2ac00a9d..e22789b532de2 100644
> --- a/drivers/s390/char/hmcdrv_ftp.c
> +++ b/drivers/s390/char/hmcdrv_ftp.c

[ ... ]

> @@ -238,16 +238,16 @@ EXPORT_SYMBOL(hmcdrv_ftp_probe);
>  ssize_t hmcdrv_ftp_cmd(char __kernel *cmd, loff_t offset,
>  		       char __user *buf, size_t len)
>  {
> -	int order;
> -
>  	struct hmcdrv_ftp_cmdspec ftp = {.len = len, .ofs = offset};
>  	ssize_t retlen = hmcdrv_ftp_parse(cmd, &ftp);
>  
>  	if (retlen)
>  		return retlen;
>  
> -	order = get_order(ftp.len);
> -	ftp.buf = (void *) __get_free_pages(GFP_KERNEL | GFP_DMA, order);
> +	if (!ftp.len || ftp.len > KMALLOC_MAX_SIZE)
> +		return -ENOMEM;

[Severity: Medium]
Does rejecting !ftp.len here break zero-length commands such as
HMCDRV_FTP_DELETE?

Previously, get_order(0) returned 0 and __get_free_pages() allocated one
page while leaving ftp.len set to 0, allowing a 0-byte read() or write()
on /dev/hmcdrv (via hmcdrv_dev_transfer() -> hmcdrv_ftp_cmd()) to execute
commands that carry no payload.  With this check, those requests fail with
-ENOMEM.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-s390-char-ready-v1-0-3db507722530@kernel.org?part=5