Re: [PATCH RFC 04/12] dma-coherent: add base and size APIs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] dma: integer overflow in dma_dev_coherent_size()
--

commit c7a3821680bbb5546ff7e7a9e6fe376429788c67
Author: Francesco Valla <francesco@valla.it>

dma-coherent: add base and size APIs

This commit adds two new APIs, dma_dev_coherent_size() and
dma_dev_coherent_base(), to retrieve the size and base address of the
coherent memory pool associated with a device.

> diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c
> index 45bbae947f4be..f4aa5813604b8 100644
> --- a/kernel/dma/coherent.c
> +++ b/kernel/dma/coherent.c
[ ... ]
> @@ -277,6 +277,40 @@ int dma_mmap_from_dev_coherent(struct device *dev, struct vm_area_struct *vma,
[ ... ]
> +size_t dma_dev_coherent_size(struct device *dev)
> +{
> +	struct dma_coherent_mem *mem = dev_get_coherent_memory(dev);
> +
> +	if (!mem)
> +		return 0;
> +
> +	return (mem->size << PAGE_SHIFT);

[Severity: High]
Could this left shift overflow for large coherent pools?

If the pool size is 2GB or larger, mem->size (which is an int representing
the number of pages) will be >= 524288. Shifting a signed 32-bit integer by
PAGE_SHIFT overflows in this case, and the result incorrectly sign-extends
when implicitly cast to size_t.

This might cause the function to return an astronomically large size_t value
instead of the actual pool size, which could lead to out-of-bounds accesses
or allocation failures in callers trusting the returned size.

Would casting mem->size to size_t before the shift prevent this?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916-remoteproc_virtio_map-v1-0-dac8c5eb4aa9@valla.it?part=4