[PATCH 0/5] s390/char: replace page allocator calls with k[mz]alloc()

[PATCH 0/5] s390/char: replace page allocator calls with k[mz]alloc()

[Mike Rapoport (Microsoft)]

This the next episode of conversion of page allocator calls to kmalloc
family :)

This series covers s390 character drivers other than SCLP.

= tl;dr cover letter copied from the previous posts:

This is a (small) part of larger work of replacing page allocator calls
with kmalloc.

My initial intention a few month ago was to remove ugly casts [1], but then
willy pointed out that Linus objected to something like this [2] and it
looks like more than a decade old technical debt.

Largely, anything that doesn't need struct page (or a memdesc in the
future) should just use kmalloc() or kvmalloc() to allocate memory.
kmalloc() guarantees alignment, physical contiguity and working
virt_to_phys() and beside nicer API that returns void * on alloc and
doesn't require to know the allocation size on free, kmalloc() provides
better debugging capabilities than page allocator.

Another thing is that touching these allocation sites gives the reviewers
opportunity to see if a PAGE_SIZE buffer is actually needed or maybe
another size is appropriate.

For larger allocations that don't need physically contiguous memory
kvmalloc() can be a better option that __get_free_pages() because under
memory pressure it's is easier to allocate several order-0 pages than a
physically contiguous chunk with the same number of pages.

And last, but not least, removing needless calls to page allocator should
help with memdesc (aka project folio) conversion. There will be way less
places to audit to see if the user was actually using struct page.

The patches are deliberately kept small, so that every conversion can be
reviewed, and if needed reverted, on its own.

Also in git:
https://git.kernel.org/pub/scm/linux/kernel/git/rppt/linux.git gfp-to-kmalloc/s390-char

[1] https://lore.kernel.org/all/20251018093002.3660549-1-rppt@kernel.org/
[2] https://lore.kernel.org/all/CA+55aFwp4iy4rtX2gE2WjBGFL=NxMVnoFeHqYa2j1dYOMMGqxg@mail.gmail.com/

---
Mike Rapoport (Microsoft) (5):
      s390/zcore: Replace __get_free_page() with kmalloc()
      s390/vmur: Replace __get_free_page() with kmalloc()
      s390/vmlogrdr: Replace get_zeroed_page() with kzalloc()
      s390/uvdevice: Replace get_zeroed_page() with kzalloc()
      s390/hmcdrv: Replace page allocator calls with k[mz]alloc()

 drivers/s390/char/diag_ftp.c     |  5 +++--
 drivers/s390/char/hmcdrv_cache.c | 18 +++++++++---------
 drivers/s390/char/hmcdrv_ftp.c   | 14 +++++++-------
 drivers/s390/char/uvdevice.c     |  4 ++--
 drivers/s390/char/vmlogrdr.c     |  4 ++--
 drivers/s390/char/vmur.c         |  8 ++++----
 drivers/s390/char/zcore.c        |  8 ++++----
 7 files changed, 31 insertions(+), 30 deletions(-)
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20260907-s390-char-ready-29b03a1bf781

--
Sincerely yours,
Mike.

[PATCH 1/5] s390/zcore: Replace __get_free_page() with kmalloc()

[Mike Rapoport (Microsoft)]

zcore_reipl_init() allocates buffers that keep a copy of the IPL block
and of the OS info structure of the crashed system.

These buffers can be allocated with kmalloc() as there's nothing special
about them to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of __get_free_page() with kmalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/s390/char/zcore.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index 1ab7400a3c10f..92e31a8a7f242 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -224,7 +224,7 @@ static int __init zcore_reipl_init(void)
 		return rc;
 	if (ipib_info.ipib == 0)
 		return 0;
-	zcore_ipl_block = (void *) __get_free_page(GFP_KERNEL);
+	zcore_ipl_block = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!zcore_ipl_block)
 		return -ENOMEM;
 	if (ipib_info.ipib < sclp.hsa_size)
@@ -235,7 +235,7 @@ static int __init zcore_reipl_init(void)
 	if (rc || (__force u32)csum_partial(zcore_ipl_block, zcore_ipl_block->hdr.len, 0) !=
 	    ipib_info.checksum) {
 		TRACE("Checksum does not match\n");
-		free_page((unsigned long) zcore_ipl_block);
+		kfree(zcore_ipl_block);
 		zcore_ipl_block = NULL;
 	}
 	/*
@@ -244,7 +244,7 @@ static int __init zcore_reipl_init(void)
 	 * to continue dump processing, considering that os_info could be
 	 * corrupted on the panicked system.
 	 */
-	os_info = (void *)__get_free_page(GFP_KERNEL);
+	os_info = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!os_info)
 		return -ENOMEM;
 	rc = memcpy_hsa_kernel(&os_info_addr, __LC_OS_INFO, sizeof(os_info_addr));
@@ -266,7 +266,7 @@ static int __init zcore_reipl_init(void)
 			os_info_flags = 0;
 	}
 out:
-	free_page((unsigned long)os_info);
+	kfree(os_info);
 	return 0;
 }
 

-- 
2.53.0

Re: [PATCH 1/5] s390/zcore: Replace __get_free_page() with kmalloc()

[sashiko-bot]

> zcore_reipl_init() allocates buffers that keep a copy of the IPL block
> and of the OS info structure of the crashed system.
> 
> These buffers can be allocated with kmalloc() as there's nothing special
> about them to go directly to the page allocator.
> 
> kmalloc() provides a better API that does not require ugly casts and
> kfree() does not need to know the size of the freed object.
> 
> Performance difference between kmalloc() and __get_free_pages() is not
> measurable as both allocators take an object/page from a per-CPU list for
> fast path allocations.
> 
> For the slow path the performance is anyway determined by the amount of
> reclaim involved rather than by what allocator is used.
> 
> Replace use of __get_free_page() with kmalloc() and free_page() with
> kfree().
> 
> Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-s390-char-ready-v1-0-3db507722530@kernel.org?part=1

[PATCH 2/5] s390/vmur: Replace __get_free_page() with kmalloc()

[Mike Rapoport (Microsoft)]

diag14_read() and verify_uri_device() allocate the buffers that receive
the spool file data returned by z/VM DIAGNOSE 0x14.

These buffers can be allocated with kmalloc() as there's nothing special
about them to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of __get_free_page() with kmalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/s390/char/vmur.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index a47a40fac8483..a13839d70eb20 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -529,7 +529,7 @@ static ssize_t diag14_read(struct file *file, char __user *ubuf, size_t count,
 		return rc;
 
 	len = min((size_t) PAGE_SIZE, count);
-	buf = (char *) __get_free_page(GFP_KERNEL | GFP_DMA);
+	buf = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
 	if (!buf)
 		return -ENOMEM;
 
@@ -556,7 +556,7 @@ static ssize_t diag14_read(struct file *file, char __user *ubuf, size_t count,
 	*offs += copied;
 	rc = copied;
 fail:
-	free_page((unsigned long) buf);
+	kfree(buf);
 	return rc;
 }
 
@@ -621,7 +621,7 @@ static int verify_uri_device(struct urdev *urd)
 	}
 
 	/* open file on virtual reader	*/
-	buf = (char *) __get_free_page(GFP_KERNEL | GFP_DMA);
+	buf = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
 	if (!buf) {
 		rc = -ENOMEM;
 		goto fail_free_fcb;
@@ -641,7 +641,7 @@ static int verify_uri_device(struct urdev *urd)
 	rc = 0;
 
 fail_free_buf:
-	free_page((unsigned long) buf);
+	kfree(buf);
 fail_free_fcb:
 	kfree(fcb);
 	return rc;

-- 
2.53.0

Re: [PATCH 2/5] s390/vmur: Replace __get_free_page() with kmalloc()

[sashiko-bot]

> diag14_read() and verify_uri_device() allocate the buffers that receive
> the spool file data returned by z/VM DIAGNOSE 0x14.
> 
> These buffers can be allocated with kmalloc() as there's nothing special
> about them to go directly to the page allocator.
> 
> kmalloc() provides a better API that does not require ugly casts and
> kfree() does not need to know the size of the freed object.
> 
> Performance difference between kmalloc() and __get_free_pages() is not
> measurable as both allocators take an object/page from a per-CPU list for
> fast path allocations.
> 
> For the slow path the performance is anyway determined by the amount of
> reclaim involved rather than by what allocator is used.
> 
> Replace use of __get_free_page() with kmalloc() and free_page() with
> kfree().
> 
> Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-s390-char-ready-v1-0-3db507722530@kernel.org?part=2

[PATCH 3/5] s390/vmlogrdr: Replace get_zeroed_page() with kzalloc()

[Mike Rapoport (Microsoft)]

vmlogrdr_init() allocates the buffers used to receive z/VM system
service records via IUCV.

These buffers can be allocated with kmalloc() as there's nothing special
about them to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of get_zeroed_page() with kzalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/s390/char/vmlogrdr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index 005735a899203..229a0f71dc453 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -793,7 +793,7 @@ static void vmlogrdr_cleanup(void)
 	}
 	for (i=0; i < MAXMINOR; ++i ) {
 		vmlogrdr_unregister_device(&sys_ser[i]);
-		free_page((unsigned long)sys_ser[i].buffer);
+		kfree(sys_ser[i].buffer);
 	}
 	vmlogrdr_unregister_driver();
 	if (vmlogrdr_major) {
@@ -826,7 +826,7 @@ static int __init vmlogrdr_init(void)
 		goto cleanup;
 
 	for (i=0; i < MAXMINOR; ++i ) {
-		sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
+		sys_ser[i].buffer = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
 		if (!sys_ser[i].buffer) {
 			rc = -ENOMEM;
 			break;

-- 
2.53.0

Re: [PATCH 3/5] s390/vmlogrdr: Replace get_zeroed_page() with kzalloc()

[sashiko-bot]

> vmlogrdr_init() allocates the buffers used to receive z/VM system
> service records via IUCV.
> 
> These buffers can be allocated with kmalloc() as there's nothing special
> about them to go directly to the page allocator.
> 
> kmalloc() provides a better API that does not require ugly casts and
> kfree() does not need to know the size of the freed object.
> 
> Performance difference between kmalloc() and __get_free_pages() is not
> measurable as both allocators take an object/page from a per-CPU list for
> fast path allocations.
> 
> For the slow path the performance is anyway determined by the amount of
> reclaim involved rather than by what allocator is used.
> 
> Replace use of get_zeroed_page() with kzalloc() and free_page() with
> kfree().
> 
> Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-s390-char-ready-v1-0-3db507722530@kernel.org?part=3

[PATCH 4/5] s390/uvdevice: Replace get_zeroed_page() with kzalloc()

[Mike Rapoport (Microsoft)]

uvio_list_secrets() allocates the buffer that receives the list of
secrets returned by the Ultravisor.

This buffer can be allocated with kmalloc() as there's nothing special
about it to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of get_zeroed_page() with kzalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/s390/char/uvdevice.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/char/uvdevice.c b/drivers/s390/char/uvdevice.c
index 4d274a2ee84dd..5375cbef2810c 100644
--- a/drivers/s390/char/uvdevice.c
+++ b/drivers/s390/char/uvdevice.c
@@ -371,13 +371,13 @@ static int uvio_list_secrets(struct uvio_ioctl_cb *uv_ioctl)
 	    uv_ioctl->argument_len % UVIO_LIST_SECRETS_LEN != 0)
 		return -EINVAL;
 
-	zpage = (void *)get_zeroed_page(GFP_KERNEL);
+	zpage = kzalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!zpage)
 		return -ENOMEM;
 
 	rc = uvio_get_list(zpage, uv_ioctl);
 
-	free_page((unsigned long)zpage);
+	kfree(zpage);
 	return rc;
 }
 

-- 
2.53.0

Re: [PATCH 4/5] s390/uvdevice: Replace get_zeroed_page() with kzalloc()

[sashiko-bot]

> uvio_list_secrets() allocates the buffer that receives the list of
> secrets returned by the Ultravisor.
> 
> This buffer can be allocated with kmalloc() as there's nothing special
> about it to go directly to the page allocator.
> 
> kmalloc() provides a better API that does not require ugly casts and
> kfree() does not need to know the size of the freed object.
> 
> Performance difference between kmalloc() and __get_free_pages() is not
> measurable as both allocators take an object/page from a per-CPU list for
> fast path allocations.
> 
> For the slow path the performance is anyway determined by the amount of
> reclaim involved rather than by what allocator is used.
> 
> Replace use of get_zeroed_page() with kzalloc() and free_page() with
> kfree().
> 
> Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-s390-char-ready-v1-0-3db507722530@kernel.org?part=4

[PATCH 5/5] s390/hmcdrv: Replace page allocator calls with k[mz]alloc()

[Mike Rapoport (Microsoft)]

diag_ftp_cmd() allocates the DIAGNOSE 0x2C4 parameter list used for HMC
file transfers under z/VM, hmcdrv_ftp_probe() and hmcdrv_ftp_cmd()
allocate the data buffers used for the transfers and
hmcdrv_cache_startup() allocates the buffer that caches the contents of
the last file read from the HMC drive.

These buffers can be allocated with kmalloc() as there's nothing special
about them to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of get_zeroed_page() and __get_free_pages() with kzalloc()
and kmalloc() and free_page[s]() with kfree().

Round transfer and cache buffers up to a page for the required 4K
alignment, without rounding to a power-of-two number of pages. Reject
unsupported sizes before rounding.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/s390/char/diag_ftp.c     |  5 +++--
 drivers/s390/char/hmcdrv_cache.c | 18 +++++++++---------
 drivers/s390/char/hmcdrv_ftp.c   | 14 +++++++-------
 3 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/drivers/s390/char/diag_ftp.c b/drivers/s390/char/diag_ftp.c
index 0a506559799eb..174c65a6e6052 100644
--- a/drivers/s390/char/diag_ftp.c
+++ b/drivers/s390/char/diag_ftp.c
@@ -10,6 +10,7 @@
 #define pr_fmt(fmt) "hmcdrv: " fmt
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/irq.h>
 #include <linux/wait.h>
@@ -152,7 +153,7 @@ ssize_t diag_ftp_cmd(const struct hmcdrv_ftp_cmdspec *ftp, size_t *fsize)
 #endif
 	init_completion(&diag_ftp_rx_complete);
 
-	ldfpl = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
+	ldfpl = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
 	if (!ldfpl) {
 		len = -ENOMEM;
 		goto out;
@@ -208,7 +209,7 @@ ssize_t diag_ftp_cmd(const struct hmcdrv_ftp_cmdspec *ftp, size_t *fsize)
 	}
 
 out_free:
-	free_page((unsigned long) ldfpl);
+	kfree(ldfpl);
 out:
 	return len;
 }
diff --git a/drivers/s390/char/hmcdrv_cache.c b/drivers/s390/char/hmcdrv_cache.c
index 85fb689594ca8..4857c543a2ef4 100644
--- a/drivers/s390/char/hmcdrv_cache.c
+++ b/drivers/s390/char/hmcdrv_cache.c
@@ -11,6 +11,7 @@
 
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <linux/jiffies.h>
 
 #include "hmcdrv_ftp.h"
@@ -42,7 +43,6 @@ struct hmcdrv_cache_entry {
 	size_t len;
 };
 
-static int hmcdrv_cache_order; /* cache allocated page order */
 
 static struct hmcdrv_cache_entry hmcdrv_cache_file = {
 	.fsize = SIZE_MAX,
@@ -214,11 +214,14 @@ ssize_t hmcdrv_cache_cmd(const struct hmcdrv_ftp_cmdspec *ftp,
  */
 int hmcdrv_cache_startup(size_t cachesize)
 {
+	if (cachesize > KMALLOC_MAX_SIZE)
+		return -ENOMEM;
+
 	if (cachesize > 0) { /* perform caching ? */
-		hmcdrv_cache_order = get_order(cachesize);
+		/* the buffer must be 4k aligned, hence round up to page size */
 		hmcdrv_cache_file.content =
-			(void *) __get_free_pages(GFP_KERNEL | GFP_DMA,
-						  hmcdrv_cache_order);
+			kmalloc(round_up(cachesize, PAGE_SIZE),
+				GFP_KERNEL | GFP_DMA);
 
 		if (!hmcdrv_cache_file.content) {
 			pr_err("Allocating the requested cache size of %zu bytes failed\n",
@@ -239,11 +242,8 @@ int hmcdrv_cache_startup(size_t cachesize)
  */
 void hmcdrv_cache_shutdown(void)
 {
-	if (hmcdrv_cache_file.content) {
-		free_pages((unsigned long) hmcdrv_cache_file.content,
-			   hmcdrv_cache_order);
-		hmcdrv_cache_file.content = NULL;
-	}
+	kfree(hmcdrv_cache_file.content);
+	hmcdrv_cache_file.content = NULL;
 
 	hmcdrv_cache_file.id = HMCDRV_FTP_NOOP;
 	hmcdrv_cache_file.fsize = LLONG_MAX;
diff --git a/drivers/s390/char/hmcdrv_ftp.c b/drivers/s390/char/hmcdrv_ftp.c
index 3312b2ac00a9d..e22789b532de2 100644
--- a/drivers/s390/char/hmcdrv_ftp.c
+++ b/drivers/s390/char/hmcdrv_ftp.c
@@ -194,7 +194,7 @@ int hmcdrv_ftp_probe(void)
 		.len = PAGE_SIZE
 	};
 
-	ftp.buf = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
+	ftp.buf = kzalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
 
 	if (!ftp.buf)
 		return -ENOMEM;
@@ -218,7 +218,7 @@ int hmcdrv_ftp_probe(void)
 		break;
 	} /* switch */
 out:
-	free_page((unsigned long) ftp.buf);
+	kfree(ftp.buf);
 	return rc;
 }
 EXPORT_SYMBOL(hmcdrv_ftp_probe);
@@ -238,16 +238,16 @@ EXPORT_SYMBOL(hmcdrv_ftp_probe);
 ssize_t hmcdrv_ftp_cmd(char __kernel *cmd, loff_t offset,
 		       char __user *buf, size_t len)
 {
-	int order;
-
 	struct hmcdrv_ftp_cmdspec ftp = {.len = len, .ofs = offset};
 	ssize_t retlen = hmcdrv_ftp_parse(cmd, &ftp);
 
 	if (retlen)
 		return retlen;
 
-	order = get_order(ftp.len);
-	ftp.buf = (void *) __get_free_pages(GFP_KERNEL | GFP_DMA, order);
+	if (!ftp.len || ftp.len > KMALLOC_MAX_SIZE)
+		return -ENOMEM;
+
+	ftp.buf = kmalloc(round_up(ftp.len, PAGE_SIZE), GFP_KERNEL | GFP_DMA);
 
 	if (!ftp.buf)
 		return -ENOMEM;
@@ -280,7 +280,7 @@ ssize_t hmcdrv_ftp_cmd(char __kernel *cmd, loff_t offset,
 		break;
 	}
 
-	free_pages((unsigned long) ftp.buf, order);
+	kfree(ftp.buf);
 	return retlen;
 }
 

-- 
2.53.0

Re: [PATCH 5/5] s390/hmcdrv: Replace page allocator calls with k[mz]alloc()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] s390/hmcdrv: zero-length requests rejected with -ENOMEM in
  hmcdrv_ftp_cmd()
--

commit 64ed22d8db2caf381431154b54f669d68274ef30
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

s390/hmcdrv: Replace page allocator calls with k[mz]alloc()

This commit replaces get_zeroed_page(), __get_free_pages(), and
free_page[s]() in the s390 hmcdrv driver with kzalloc(), kmalloc(), and
kfree(), rounding buffer sizes up to PAGE_SIZE.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/s390/char/hmcdrv_ftp.c b/drivers/s390/char/hmcdrv_ftp.c
> index 3312b2ac00a9d..e22789b532de2 100644
> --- a/drivers/s390/char/hmcdrv_ftp.c
> +++ b/drivers/s390/char/hmcdrv_ftp.c

[ ... ]

> @@ -238,16 +238,16 @@ EXPORT_SYMBOL(hmcdrv_ftp_probe);
>  ssize_t hmcdrv_ftp_cmd(char __kernel *cmd, loff_t offset,
>  		       char __user *buf, size_t len)
>  {
> -	int order;
> -
>  	struct hmcdrv_ftp_cmdspec ftp = {.len = len, .ofs = offset};
>  	ssize_t retlen = hmcdrv_ftp_parse(cmd, &ftp);
>  
>  	if (retlen)
>  		return retlen;
>  
> -	order = get_order(ftp.len);
> -	ftp.buf = (void *) __get_free_pages(GFP_KERNEL | GFP_DMA, order);
> +	if (!ftp.len || ftp.len > KMALLOC_MAX_SIZE)
> +		return -ENOMEM;

[Severity: Medium]
Does rejecting !ftp.len here break zero-length commands such as
HMCDRV_FTP_DELETE?

Previously, get_order(0) returned 0 and __get_free_pages() allocated one
page while leaving ftp.len set to 0, allowing a 0-byte read() or write()
on /dev/hmcdrv (via hmcdrv_dev_transfer() -> hmcdrv_ftp_cmd()) to execute
commands that carry no payload.  With this check, those requests fail with
-ENOMEM.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-s390-char-ready-v1-0-3db507722530@kernel.org?part=5