Re: [PATCH 05/13] s390/cio: Use kzalloc() for CHSC work areas

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Replacing get_zeroed_page() with kzalloc() for CHSC (Channel Subsystem Call) memory blocks breaks the strict 4KB hardware alignment requirement when SLUB debugging or KASAN is enabled.
--

commit 9694c5915181f336b62527d191701841da8a5e9a
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

s390/cio: Use kzalloc() for CHSC work areas

chsc_init() allocates the work area for chsc commands and
qdio_allocate() allocates one for chsc calls during qdio_establish().
This commit replaces the use of get_zeroed_page() with kzalloc() and
free_page() with kfree() for these allocations.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
> index c3186c0a372b4..d98f629e89295 100644
> --- a/drivers/s390/cio/chsc.c
> +++ b/drivers/s390/cio/chsc.c
> @@ -1143,7 +1143,7 @@ int __init chsc_init(void)
>  	int ret;
>  
>  	sei_page = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
> -	chsc_page = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
> +	chsc_page = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);

[Severity: High]
Does replacing get_zeroed_page() with kzalloc() cause a regression by
breaking the strict 4KB hardware alignment requirement for chsc command
blocks?

While kzalloc(PAGE_SIZE) might return page-aligned memory by default, if
slub debugging (like redzoning) or kasan is enabled, metadata is inserted
before the object, shifting the returned pointer away from the page boundary.
Passing this unaligned pointer to the chsc instruction could cause the
hardware to raise a specification exception and crash the system.

[ ... ]

> diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
> index c1e09fa34e774..d137bf8c70664 100644
> --- a/drivers/s390/cio/qdio_main.c
> +++ b/drivers/s390/cio/qdio_main.c
> @@ -986,7 +986,7 @@ int qdio_allocate(struct ccw_device *cdev, unsigned int no_input_qs,
>  	 * qdio_establish. In case of low memory and swap on a zfcp disk
>  	 * we may not be able to allocate memory otherwise.
>  	 */
> -	irq_ptr->chsc_page = get_zeroed_page(GFP_KERNEL);
> +	irq_ptr->chsc_page = kzalloc(PAGE_SIZE, GFP_KERNEL);

[Severity: High]
Could this allocation introduce a similar regression with 4KB hardware
alignment?

Since the qdio chsc page is also used for hardware instructions in
qdio_setup_get_ssqd() and set_subchannel_ind(), losing the strict page
alignment guarantees of get_zeroed_page() when debugging is enabled might
lead to unaligned command blocks and hardware specification exceptions.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907-s390-cio-ready-v1-0-ca7f39806234@kernel.org?part=5