Re: [PATCH net] s390/ism: folio_put() after error

[Alexandra Winter <wintera@linux.ibm.com>]

Corrected To Julian

On 03.09.26 18:40, Alexandra Winter wrote:
> 
> 
> On 03.09.26 16:37, sashiko-bot@kernel.org wrote:
>> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>>
>> Pre-existing issues:
>> - [Critical] Missing __GFP_ZERO in folio_alloc() causes uninitialized kernel memory to be exposed in the receive message buffer.
>> --
>>
>> commit d942ada155dde57df3b8bd6857db438603cbd218
>> Author: Alexandra Winter <wintera@linux.ibm.com>
>>
>> s390/ism: folio_put() after error
>>
>> This commit uses folio_put() instead of kfree() in the error path of
>> ism_alloc_dmb() to prevent slab allocator corruption. It also sets
>> dmb->cpu_addr to NULL after freeing to prevent a potential use-after-free.
>>
>> Fixes: 83781384a96b ("s390/ism: Properly fix receive message buffer allocation")
>>
>>> diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
>>> index 242da20f27e0e..035b233abb4e9 100644
>>> --- a/drivers/s390/net/ism_drv.c
>>> +++ b/drivers/s390/net/ism_drv.c
>> [ ... ]
>>> @@ -274,7 +275,8 @@ static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb)
>>>  	return 0;
>>>  
>>>  out_free:
>>> -	kfree(dmb->cpu_addr);
>>> +	folio_put(folio);
>>
>> [Severity: Critical]
>> This isn't a bug introduced by this patch, but the previous replacement
>> of dma_alloc_coherent() with folio_alloc() removed the implicit
>> zero-initialization of the Direct Message Buffer (DMB).
>>
>> Looking at the allocation earlier in ism_alloc_dmb():
>>
>> drivers/s390/net/ism_drv.c:ism_alloc_dmb() {
>>         ...
>>         folio = folio_alloc(GFP_KERNEL | __GFP_NOWARN | __GFP_NOMEMALLOC |
>>                             __GFP_NORETRY, get_order(dmb->dmb_len));
>>         ...
>> }
>>
>> Does this missing __GFP_ZERO leak uninitialized host kernel memory to an
>> untrusted remote peer?
>>
> 
> This is actually already on my ToDo list.
> See also my discussion with Julian on 12.08.2026 about
> Re: [PATCH v2 1/6] dibs: remove __GFP_ZERO from loopback
> 
> 
> 
>> A remote, unprivileged peer partition can trigger an SMC connection
>> establishment via smcd_new_buf_create() -> smc_ism_register_dmb(). This
>> causes the local host to allocate and map the DMB memory without
>> zero-filling it locally before the peer partition gains access to it,
>> potentially exposing uninitialized memory across the virtual machine or
>> LPAR boundary.
>>
>>> +	dmb->cpu_addr = NULL;
>>>  out_bit:
>>>  	clear_bit(dmb->idx, ism->sba_bitmap);
>>>  	return rc;
>>
>