[PATCH v2 0/3] tty: replace page allocator calls with k[mz]alloc()

[PATCH v2 0/3] tty: replace page allocator calls with k[mz]alloc()

[Mike Rapoport (Microsoft)]

This is a (small) part of larger work of replacing page allocator calls
with kmalloc.

My initial intention a few month ago was to remove ugly casts [1], but then
willy pointed out that Linus objected to something like this [2] and it
looks like more than a decade old technical debt.

Largely, anything that doesn't need struct page (or a memdesc in the
future) should just use kmalloc() or kvmalloc() to allocate memory.
kmalloc() guarantees alignment, physical contiguity and working
virt_to_phys() and beside nicer API that returns void * on alloc and
doesn't require to know the allocation size on free, kmalloc() provides
better debugging capabilities than page allocator.

Another thing is that touching these allocation sites gives the reviewers
opportunity to see if a PAGE_SIZE buffer is actually needed or maybe
another size is appropriate.

For larger allocations that don't need physically contiguous memory
kvmalloc() can be a better option that __get_free_pages() because under
memory pressure it's is easier to allocate several order-0 pages than a
physically contiguous chunk with the same number of pages.

And last, but not least, removing needless calls to page allocator should
help with memdesc (aka project folio) conversion. There will be way less
places to audit to see if the user was actually using struct page.

The patches are deliberately kept small: each one deals with a single
driver or subsystem and with a single type of allocation, so that every
conversion can be reviewed, and if needed reverted, on its own.

[1] https://lore.kernel.org/all/20251018093002.3660549-1-rppt@kernel.org/
[2] https://lore.kernel.org/all/CA+55aFwp4iy4rtX2gE2WjBGFL=NxMVnoFeHqYa2j1dYOMMGqxg@mail.gmail.com/

---
v2 changes:
* change xmit_buf type in uart_{alloc,free}_xmit_buf() to u8 *

v1: https://patch.msgid.link/20260830-tty-v1-0-0cbe6170649b@kernel.org

---
Mike Rapoport (Microsoft) (3):
      tty: port: replace get_zeroed_page() with kzalloc()
      serial: core: replace get_zeroed_page() with kzalloc()
      tty: hvcs: replace __get_free_page() with kmalloc()

 drivers/tty/hvc/hvcs.c           |  6 +++---
 drivers/tty/serial/serial_core.c | 18 +++++++++---------
 drivers/tty/tty_port.c           |  8 ++++----
 3 files changed, 16 insertions(+), 16 deletions(-)
---
base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1
change-id: 20260829-tty-84f05b74862a

--
Sincerely yours,
Mike.

[PATCH v2 1/3] tty: port: replace get_zeroed_page() with kzalloc()

[Mike Rapoport (Microsoft)]

tty_port_alloc_xmit_buf() allocates the transmit buffer of a tty port. The
buffer only backs the port's kfifo, the data being sent is copied in and
out of it.

This buffer can be allocated with kmalloc() as there's nothing special
about it to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of get_zeroed_page() with kzalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Assisted-by: copilot:claude-opus
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/tty/tty_port.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 54359310e293c..44122921fc45b 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -240,13 +240,13 @@ EXPORT_SYMBOL_GPL(tty_port_unregister_device);
 
 int tty_port_alloc_xmit_buf(struct tty_port *port)
 {
-	/* We may sleep in get_zeroed_page() */
+	/* We may sleep in kzalloc() */
 	guard(mutex)(&port->buf_mutex);
 
 	if (port->xmit_buf)
 		return 0;
 
-	port->xmit_buf = (u8 *)get_zeroed_page(GFP_KERNEL);
+	port->xmit_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
 	if (port->xmit_buf == NULL)
 		return -ENOMEM;
 
@@ -259,7 +259,7 @@ EXPORT_SYMBOL(tty_port_alloc_xmit_buf);
 void tty_port_free_xmit_buf(struct tty_port *port)
 {
 	guard(mutex)(&port->buf_mutex);
-	free_page((unsigned long)port->xmit_buf);
+	kfree(port->xmit_buf);
 	port->xmit_buf = NULL;
 	INIT_KFIFO(port->xmit_fifo);
 }
@@ -288,7 +288,7 @@ static void tty_port_destructor(struct kref *kref)
 	/* check if last port ref was dropped before tty release */
 	if (WARN_ON(port->itty))
 		return;
-	free_page((unsigned long)port->xmit_buf);
+	kfree(port->xmit_buf);
 	tty_port_destroy(port);
 	if (port->ops && port->ops->destruct)
 		port->ops->destruct(port);

-- 
2.53.0

Re: [PATCH v2 1/3] tty: port: replace get_zeroed_page() with kzalloc()

[sashiko-bot]

> tty_port_alloc_xmit_buf() allocates the transmit buffer of a tty port. The
> buffer only backs the port's kfifo, the data being sent is copied in and
> out of it.
> 
> This buffer can be allocated with kmalloc() as there's nothing special
> about it to go directly to the page allocator.
> 
> kmalloc() provides a better API that does not require ugly casts and
> kfree() does not need to know the size of the freed object.
> 
> Performance difference between kmalloc() and __get_free_pages() is not
> measurable as both allocators take an object/page from a per-CPU list for
> fast path allocations.
> 
> For the slow path the performance is anyway determined by the amount of
> reclaim involved rather than by what allocator is used.
> 
> Replace use of get_zeroed_page() with kzalloc() and free_page() with
> kfree().
> 
> Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
> Assisted-by: copilot:claude-opus
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-tty-v2-0-88cd58c3c640@kernel.org?part=1

[PATCH v2 2/3] serial: core: replace get_zeroed_page() with kzalloc()

[Mike Rapoport (Microsoft)]

uart_alloc_xmit_buf() allocates the transmit buffer of a serial port. The
buffer only backs the port's kfifo, the data being sent is copied in and
out of it.

This buffer can be allocated with kmalloc() as there's nothing special
about it to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

While on it, make the local variable holding the buffer a pointer to get
rid of the casts.

Replace use of get_zeroed_page() with kzalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Assisted-by: copilot:claude-opus
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/tty/serial/serial_core.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 95774b0f1484b..a72fe14f76771 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -247,29 +247,29 @@ static int uart_alloc_xmit_buf(struct tty_port *port)
 	struct uart_state *state = container_of(port, struct uart_state, port);
 	struct uart_port *uport;
 	unsigned long flags;
-	unsigned long page;
+	u8 *buf;
 
 	/*
 	 * Initialise and allocate the transmit and temporary
 	 * buffer.
 	 */
-	page = get_zeroed_page(GFP_KERNEL);
-	if (!page)
+	buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!buf)
 		return -ENOMEM;
 
 	uport = uart_port_ref_lock(state, &flags);
 	if (!state->port.xmit_buf) {
-		state->port.xmit_buf = (unsigned char *)page;
+		state->port.xmit_buf = buf;
 		kfifo_init(&state->port.xmit_fifo, state->port.xmit_buf,
 				PAGE_SIZE);
 		uart_port_unlock_deref(uport, flags);
 	} else {
 		uart_port_unlock_deref(uport, flags);
 		/*
-		 * Do not free() the page under the port lock, see
+		 * Do not free() the buffer under the port lock, see
 		 * uart_free_xmit_buf().
 		 */
-		free_page(page);
+		kfree(buf);
 	}
 
 	return 0;
@@ -280,10 +280,10 @@ static void uart_free_xmit_buf(struct tty_port *port)
 	struct uart_state *state = container_of(port, struct uart_state, port);
 	struct uart_port *uport;
 	unsigned long flags;
-	char *xmit_buf;
+	u8 *xmit_buf;
 
 	/*
-	 * Do not free() the transmit buffer page under the port lock since
+	 * Do not free() the transmit buffer under the port lock since
 	 * this can create various circular locking scenarios. For instance,
 	 * console driver may need to allocate/free a debug object, which
 	 * can end up in printk() recursion.
@@ -294,7 +294,7 @@ static void uart_free_xmit_buf(struct tty_port *port)
 	INIT_KFIFO(port->xmit_fifo);
 	uart_port_unlock_deref(uport, flags);
 
-	free_page((unsigned long)xmit_buf);
+	kfree(xmit_buf);
 }
 
 /*

-- 
2.53.0

Re: [PATCH v2 2/3] serial: core: replace get_zeroed_page() with kzalloc()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Replacing get_zeroed_page() with kzalloc(PAGE_SIZE) drops the page-alignment guarantee, breaking UART drivers that map xmit_buf for DMA.
--

commit 1bc591e29475edce55380edd521d83cecd0b99ca
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

serial: core: replace get_zeroed_page() with kzalloc()

This commit replaces the buddy allocator get_zeroed_page() with
kzalloc(PAGE_SIZE) for allocating the serial port transmit buffer. It also
updates the variable type from unsigned long to a pointer to avoid casts.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index 95774b0f1484b..a72fe14f76771 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
[ ... ]
> @@ -247,29 +247,29 @@ static int uart_alloc_xmit_buf(struct tty_port *port)
>  	struct uart_state *state = container_of(port, struct uart_state, port);
>  	struct uart_port *uport;
>  	unsigned long flags;
> -	unsigned long page;
> +	u8 *buf;
>  
>  	/*
>  	 * Initialise and allocate the transmit and temporary
>  	 * buffer.
>  	 */
> -	page = get_zeroed_page(GFP_KERNEL);
> -	if (!page)
> +	buf = kzalloc(PAGE_SIZE, GFP_KERNEL);

[Severity: Critical]
Will this alignment change break UART drivers that map xmit_buf for DMA?

When SLUB debugging (redzoning) or KASAN is enabled, kzalloc(PAGE_SIZE)
returns a buffer that is offset by metadata and no longer page-aligned.
Several drivers appear to rely on the page alignment guarantee of
get_zeroed_page().

For example, atmel_prepare_tx_dma() explicitly asserts page alignment and
will panic:

drivers/tty/serial/atmel_serial.c:atmel_prepare_tx_dma() {
        ...
        BUG_ON(!PAGE_ALIGNED(tport->xmit_buf));
        ...
}

Additionally, dma_handle_tx() in pch_uart.c assumes page alignment during
the DMA scatterlist mapping and address calculation:

drivers/tty/serial/pch_uart.c:dma_handle_tx() {
        ...
        sg_set_page(sg, virt_to_page(tport->xmit_buf),
                    rem, fifo_size * i);
        ...
        sg_dma_address(sg) = (sg_dma_address(sg) & ~(UART_XMIT_SIZE - 1)) +
                             sg->offset;
        ...
}

Because the sub-page offset of an unaligned xmit_buf is not provided to
sg_set_page(), does this cause the DMA controller to read from the page
boundary instead of the actual buffer? This could result in transmitting
SLUB metadata or adjacent kernel objects over the serial port instead of
the intended data.

> +	if (!buf)
>  		return -ENOMEM;
>  
>  	uport = uart_port_ref_lock(state, &flags);
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-tty-v2-0-88cd58c3c640@kernel.org?part=2

[PATCH v2 3/3] tty: hvcs: replace __get_free_page() with kmalloc()

[Mike Rapoport (Microsoft)]

hvcs_initialize() allocates the buffer that receives the partner info
returned by the H_VTERM_PARTNER_INFO hypercall. The buffer is passed to
the hypervisor as a physical address and it must not cross a page
boundary.

kmalloc() guarantees that a power of two sized allocation is aligned to
its size, so a PAGE_SIZE allocation is page aligned as well.

This buffer can be allocated with kmalloc() as there's nothing special
about it to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of __get_free_page() with kmalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Assisted-by: copilot:claude-opus
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/tty/hvc/hvcs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index d32b1e3c50bfd..b94d59fa36274 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -1470,7 +1470,7 @@ static int hvcs_initialize(void)
 		goto register_fail;
 	}
 
-	hvcs_pi_buff = (unsigned long *) __get_free_page(GFP_KERNEL);
+	hvcs_pi_buff = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!hvcs_pi_buff) {
 		rc = -ENOMEM;
 		goto buff_alloc_fail;
@@ -1486,7 +1486,7 @@ static int hvcs_initialize(void)
 	return 0;
 
 kthread_fail:
-	free_page((unsigned long)hvcs_pi_buff);
+	kfree(hvcs_pi_buff);
 buff_alloc_fail:
 	tty_unregister_driver(hvcs_tty_driver);
 register_fail:
@@ -1528,7 +1528,7 @@ static void __exit hvcs_module_exit(void)
 	kthread_stop(hvcs_task);
 
 	spin_lock(&hvcs_pi_lock);
-	free_page((unsigned long)hvcs_pi_buff);
+	kfree(hvcs_pi_buff);
 	hvcs_pi_buff = NULL;
 	spin_unlock(&hvcs_pi_lock);
 

-- 
2.53.0

Re: [PATCH v2 3/3] tty: hvcs: replace __get_free_page() with kmalloc()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Failure in kthread_run leaves global variables dangling and pointing to an ERR_PTR, bypassing initialization checks on subsequent probes (leading to UAF) and causing a kernel panic on module unload.
--

commit b1538891a24d98413046b6d1a4fb966407282fe0
Author: Mike Rapoport (Microsoft) <rppt@kernel.org>

tty: hvcs: replace __get_free_page() with kmalloc()

This patch replaces the use of __get_free_page() and free_page() with
kmalloc() and kfree() respectively for the hvcs_pi_buff allocation. It
simplifies the API usage and removes the need for size tracking during
deallocation.

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com

> diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
> index d32b1e3c50bfd..b94d59fa36274 100644
> --- a/drivers/tty/hvc/hvcs.c
> +++ b/drivers/tty/hvc/hvcs.c
[ ... ]
> @@ -1486,7 +1486,7 @@ static int hvcs_initialize(void)
>  	return 0;
>  
>  kthread_fail:
> -	free_page((unsigned long)hvcs_pi_buff);
> +	kfree(hvcs_pi_buff);

[Severity: High]
This isn't a bug introduced by this patch, but it looks like the error handling 
here leaves global variables dangling.

If kthread_run() fails earlier in hvcs_initialize(), it returns an ERR_PTR 
which is assigned to the global hvcs_task pointer. In this error path, 
hvcs_pi_buff is freed, but neither hvcs_task nor hvcs_pi_buff are reset to 
NULL.

Since hvcs_task is not NULL (it holds the ERR_PTR), a subsequent call to 
hvcs_initialize() might bypass initialization:

	if (hvcs_task) {
		mutex_unlock(&hvcs_init_mutex);
		return 0;
	}

Could this lead to use-after-free bugs if later code tries to use the freed 
hvcs_pi_buff?

[ ... ]
> @@ -1528,7 +1528,7 @@ static void __exit hvcs_module_exit(void)
>  	kthread_stop(hvcs_task);
>  
>  	spin_lock(&hvcs_pi_lock);
> -	free_page((unsigned long)hvcs_pi_buff);
> +	kfree(hvcs_pi_buff);

[Severity: High]
This is a pre-existing issue, but does this cleanup path attempt to dereference 
an invalid pointer if hvcs_initialize() previously failed during kthread_run()?

If hvcs_task contains an ERR_PTR, calling kthread_stop(hvcs_task) could cause 
an invalid dereference.

Also, because hvcs_pi_buff was already freed in the kthread_fail path and never 
set to NULL, would this result in a double free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-tty-v2-0-88cd58c3c640@kernel.org?part=3