Re: [PATCH 2/4] KVM: s390: Replace get_zeroed_page() with kzalloc() for the STSI buffer

[Mike Rapoport <rppt@kernel.org>]

On Wed, Sep 02, 2026 at 06:22:22AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] Replacing get_zeroed_page() with kzalloc() breaks the hardware 4K alignment requirement for the STSI buffer, creating a Guest-to-Host Denial of Service (DoS) vulnerability.
> --
> 
> commit bcd4e89cdbdb3a1d43d3845b698f4de5d334121d
> Author: Mike Rapoport (Microsoft) <rppt@kernel.org>
> 
> KVM: s390: Replace get_zeroed_page() with kzalloc() for the STSI buffer
> 
> This commit replaces get_zeroed_page() with kzalloc() for allocating
> the STSI response block buffer in the s390 KVM subsystem.
> 
> Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
> 
> > diff --git a/arch/s390/kvm/s390/priv.c b/arch/s390/kvm/s390/priv.c
> > index b3cb2c2c3aa71..856939acf012f 100644
> > --- a/arch/s390/kvm/s390/priv.c
> > +++ b/arch/s390/kvm/s390/priv.c
> [ ... ]
> > @@ -911,19 +912,19 @@ static int handle_stsi(struct kvm_vcpu *vcpu)
> >  	switch (fc) {
> >  	case 1: /* same handling for 1 and 2 */
> >  	case 2:
> > -		mem = get_zeroed_page(GFP_KERNEL_ACCOUNT);
> > +		mem = kzalloc(PAGE_SIZE, GFP_KERNEL_ACCOUNT);
> >  		if (!mem)
> >  			goto out_no_data;
> > -		if (stsi((void *) mem, fc, sel1, sel2))
> > +		if (stsi(mem, fc, sel1, sel2))
> 
> [Severity: Critical]
> Does this allocation guarantee the 4K alignment required by the STSI hardware
> instruction?
> 
> While kzalloc() for PAGE_SIZE might often return page-aligned memory, it is
> not strictly guaranteed, especially if slab debugging (CONFIG_SLUB_DEBUG)
> with redzoning or CONFIG_KASAN is enabled.

It's strictly guaranteed, see commit 59bb47985c1db ("mm, sl[aou]b:
guarantee natural alignment for kmalloc(power-of-two)")
 
-- 
Sincerely yours,
Mike.