Re: [PATCH 2/3] serial: core: replace get_zeroed_page() with kzalloc()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The transition from `get_zeroed_page(GFP_KERNEL)` to `kzalloc(PAGE_SIZE, GFP_KERNEL)` for allocating the serial port transmit buffer (`tport->xmit_buf`) breaks the strict page-alignment guarantee. Several serial drivers inherently rely on this buffer being page-aligned. `atmel_serial` explicitly panics via `BUG_ON(!PAGE_ALIGNED(tport->xmit_buf))`, and `pch_uart` corrupts DMA scatterlist addresses by masking out the lower bits (`sg_dma_address(sg) & ~(UART_XMIT_SIZE - 1)`) assuming the base address is page-aligned. If `kzalloc` returns an unaligned address (e.g., when SLUB debugging adds redzones), this results in DMA reading adjacent out-of-bounds kernel memory and transmitting it over the serial line.
--

commit 56b6291d1a96458932c4b0e5de37ae0df9e37c2d
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

serial: core: replace get_zeroed_page() with kzalloc()

This commit replaces the page allocator with kzalloc() for the serial port
transmit buffer. It aims to simplify the API and remove casts, noting that
performance differences are negligible.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index 95774b0f1484b..f12ce7d190fe6 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
> @@ -247,29 +247,29 @@ static int uart_alloc_xmit_buf(struct tty_port *port)
>  	struct uart_state *state = container_of(port, struct uart_state, port);
>  	struct uart_port *uport;
>  	unsigned long flags;
> -	unsigned long page;
> +	unsigned char *buf;
>  
>  	/*
>  	 * Initialise and allocate the transmit and temporary
>  	 * buffer.
>  	 */
> -	page = get_zeroed_page(GFP_KERNEL);
> -	if (!page)
> +	buf = kzalloc(PAGE_SIZE, GFP_KERNEL);

[Severity: Critical]
Does replacing get_zeroed_page() with kzalloc() break page alignment
requirements for the transmit buffer?

Several serial drivers appear to rely on the transmit buffer being strictly
page-aligned. For example, in drivers/tty/serial/atmel_serial.c,
atmel_prepare_tx_dma() explicitly checks for this:

    BUG_ON(!PAGE_ALIGNED(tport->xmit_buf));

Additionally, in drivers/tty/serial/pch_uart.c, dma_handle_tx() masks out
the lower bits of the DMA address, assuming the base is page-aligned:

    sg_dma_address(sg) = (sg_dma_address(sg) &
                        ~(UART_XMIT_SIZE - 1)) + sg->offset;

If kzalloc() returns an unaligned address (which can happen when SLUB
debugging adds redzones), could this result in a kernel panic in atmel_serial
or corrupted DMA scatterlist addresses in pch_uart?

Could this DMA corruption lead to out-of-bounds kernel memory being read
and transmitted over the serial line?

> +	if (!buf)
>  		return -ENOMEM;
>  
>  	uport = uart_port_ref_lock(state, &flags);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260830-tty-v1-0-0cbe6170649b@kernel.org?part=2