Re: [PATCH net v2] s390/ism: Zerorize dmb at allocation

[Alexandra Winter <wintera@linux.ibm.com>]

On 01.10.26 02:40, patchwork-bot+netdevbpf@kernel.org wrote:
> Hello:
> 
> This patch was applied to netdev/net-next.git (main)
> by Jakub Kicinski <kuba@kernel.org>:
> 
> On Mon, 28 Sep 2026 17:14:20 +0200 you wrote:
>> Sashiko reported [1] that 'Missing __GFP_ZERO in folio_alloc() causes
>> uninitialized kernel memory to be exposed in the receive message buffer'.
>> An ism dmb is receive-only, so the data is not leaked to a remote peer. In
>> general the smc kernel module (dibs client) will only push newly received
>> data to userspace. We still should not have uninitialized data in a receive
>> buffer.
>>
>> [...]
> 
> Here is the summary with links:
>   - [net,v2] s390/ism: Zerorize dmb at allocation
>     https://git.kernel.org/netdev/net-next/c/a0227fa24e8a
> 
> You are awesome, thank you!

On 29.09.26 09:59, Alexandra Winter wrote:
>
> As mentioned in the commit message this issue was reported by Sashiko and found
> valid by me. I do not see a simple reproducer.

Hello Jakub and Greg,

I did some more thinking and now I have a reproducer, where a modified remote
smc peer causes a local kernel memory leak.
Reproducer and logs can be sent upon request.

Kindly consider this for net and stable and CVE.

There is nothing wrong with the statements in the commit message,
but I should have thought more about the worst case and written
a reproducer, I guess.
Sorry about that.

Alexandra