Re: [PATCH 2/3] serial: core: replace get_zeroed_page() with kzalloc()

[Mike Rapoport <rppt@kernel.org>]

On Sun, Aug 30, 2026 at 08:00:54AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] The transition from `get_zeroed_page(GFP_KERNEL)` to `kzalloc(PAGE_SIZE, GFP_KERNEL)` for allocating the serial port transmit buffer (`tport->xmit_buf`) breaks the strict page-alignment guarantee. Several serial drivers inherently rely on this buffer being page-aligned. `atmel_serial` explicitly panics via `BUG_ON(!PAGE_ALIGNED(tport->xmit_buf))`, and `pch_uart` corrupts DMA scatterlist addresses by masking out the lower bits (`sg_dma_address(sg) & ~(UART_XMIT_SIZE - 1)`) assuming the base address is page-aligned. If `kzalloc` returns an unaligned address (e.g., when SLUB debugging adds redzones), this results in DMA reading adjacent out-of-bounds kernel memory and transmitting it over the serial line.
> --
> 
> commit 56b6291d1a96458932c4b0e5de37ae0df9e37c2d
> Author: Mike Rapoport (Microsoft) <rppt@kernel.org>
> 
> serial: core: replace get_zeroed_page() with kzalloc()
> 
> This commit replaces the page allocator with kzalloc() for the serial port
> transmit buffer. It aims to simplify the API and remove casts, noting that
> performance differences are negligible.
> 
> Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
> 
> > diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> > index 95774b0f1484b..f12ce7d190fe6 100644
> > --- a/drivers/tty/serial/serial_core.c
> > +++ b/drivers/tty/serial/serial_core.c
> > @@ -247,29 +247,29 @@ static int uart_alloc_xmit_buf(struct tty_port *port)
> >  	struct uart_state *state = container_of(port, struct uart_state, port);
> >  	struct uart_port *uport;
> >  	unsigned long flags;
> > -	unsigned long page;
> > +	unsigned char *buf;
> >  
> >  	/*
> >  	 * Initialise and allocate the transmit and temporary
> >  	 * buffer.
> >  	 */
> > -	page = get_zeroed_page(GFP_KERNEL);
> > -	if (!page)
> > +	buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
> 
> [Severity: Critical]
> Does replacing get_zeroed_page() with kzalloc() break page alignment
> requirements for the transmit buffer?

No, commit 59bb47985c1d ("mm, sl[aou]b: guarantee natural alignment for
kmalloc(power-of-two)") guarantees that PAGE_SIZE allocations are page
aligned.

-- 
Sincerely yours,
Mike.