diff options
| author | Alexandra Winter <wintera@linux.ibm.com> | 2026-09-28 17:14:20 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-09-30 17:36:00 -0700 |
| commit | a0227fa24e8a2a0397cc4eb669731ff8d9161bbd (patch) | |
| tree | 25cb9ffdc55333ebbb4cc3afbee73f7780090993 /drivers/s390 | |
| parent | 22691f0128a0155abc997eb10e108809599d7ebd (diff) | |
s390/ism: Zerorize dmb at allocation
Sashiko reported [1] that 'Missing __GFP_ZERO in folio_alloc() causes
uninitialized kernel memory to be exposed in the receive message buffer'.
An ism dmb is receive-only, so the data is not leaked to a remote peer.
In general the smc kernel module (dibs client) will only push newly
received data to userspace. We still should not have uninitialized data
in a receive buffer.
Since
commit 750afb08ca71 ("cross-tree: phase out dma_zalloc_coherent()")
dma_alloc_coherent no longer required the __GFP_ZERO flag, but when
commit 83781384a96b ("s390/ism: Properly fix receive message buffer allocation")
switched to folio_alloc(), it should have added back the __GFP_ZERO flag.
Add __GFP_ZERO flag and state in dibs.h that register_dbm() provides
a zerorized buffer (dibs_lo already does).
Link: https://lore.kernel.org/linux-s390/20260903143746.A5CC41F00A3A@smtp.kernel.org/ [1]
Fixes: 83781384a96b ("s390/ism: Properly fix receive message buffer allocation")
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Link: https://patch.msgid.link/20260928151420.383105-1-wintera@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/s390')
| -rw-r--r-- | drivers/s390/net/ism_drv.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c index 035b233abb4e..405abd99c820 100644 --- a/drivers/s390/net/ism_drv.c +++ b/drivers/s390/net/ism_drv.c @@ -256,7 +256,8 @@ static int ism_alloc_dmb(struct ism_dev *ism, struct dibs_dmb *dmb) return -EINVAL; folio = folio_alloc(GFP_KERNEL | __GFP_NOWARN | __GFP_NOMEMALLOC | - __GFP_NORETRY, get_order(dmb->dmb_len)); + __GFP_NORETRY | __GFP_ZERO, + get_order(dmb->dmb_len)); if (!folio) { rc = -ENOMEM; |