Re: [PATCH 4/4] KVM: s390: Replace get_zeroed_page() with kzalloc() for sie_page2 and CMMA

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Invalid free in SLUB allocator due to passing an unaligned interior pointer containing hardware-injected offset bits.
--

commit 7888b46f989fd0725fe9f7dbcee943460aa8c059
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

KVM: s390: Replace get_zeroed_page() with kzalloc() for sie_page2 and CMMA

This commit replaces usages of get_zeroed_page() with kzalloc() and
free_page() with kfree() for allocating sie_page2 and CMMA blocks in the
s390 KVM subsystem. It aims to simplify the API usage since power-of-two
sized kmalloc() allocations are aligned to their size.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/arch/s390/kvm/s390/s390.c b/arch/s390/kvm/s390/s390.c
> index b0839e887221e..8ec505060f8c0 100644
> --- a/arch/s390/kvm/s390/s390.c
> +++ b/arch/s390/kvm/s390/s390.c

[ ... ]

> @@ -3657,13 +3657,13 @@ static void kvm_s390_vcpu_crypto_setup(struct kvm_vcpu *vcpu)
>  void kvm_s390_vcpu_unsetup_cmma(struct kvm_vcpu *vcpu)
>  {
>  	if (vcpu->arch.sie_block->cbrlo)
> -		free_page((unsigned long)phys_to_virt(vcpu->arch.sie_block->cbrlo));
> +		kfree(phys_to_virt(vcpu->arch.sie_block->cbrlo));

[Severity: High]
Does this code pass an unaligned interior pointer to the SLUB allocator?

During execution, the SIE hardware modifies the lower 12 bits of cbrlo to
store the Next CBR Entry Offset (NCEO). On VM teardown, if the hardware
has updated this count and it wasn't explicitly reset, the unmasked cbrlo
value is passed to kfree().

The previous free_page() implementation safely dropped these offset bits
because virt_to_page() implicitly applies PAGE_SHIFT. However, kfree()
requires the exact, unmodified pointer originally returned by the allocator.
Passing an interior pointer can lead to immediate freelist corruption and a
subsequent kernel panic.

>  	vcpu->arch.sie_block->cbrlo = 0;
>  }
>  
>  int kvm_s390_vcpu_setup_cmma(struct kvm_vcpu *vcpu)
>  {
> -	void *cbrlo_page = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT);
> +	void *cbrlo_page = kzalloc(PAGE_SIZE, GFP_KERNEL_ACCOUNT);
>  
>  	if (!cbrlo_page)
>  		return -ENOMEM;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902-s390-kvm-v1-0-3bc0986550b1@kernel.org?part=4