Re: [PATCHv2] dmaengine: ste_dma40: turn d40_base phy_chans into a flexible array

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Defeating struct_size() saturation arithmetic with unchecked addition can lead to a heap buffer overflow.
--

commit e3bf7e1250eb198cd9bf4617a8f0c3d6cc4d796b
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: ste_dma40: turn d40_base phy_chans into a flexible array

This commit converts the separately-offset phy_chans pointer to a C99 flexible
array member at the end of struct d40_base, switching the allocation to
struct_size(). The log_chans and memcpy_chans slots continue to live in the
same allocation immediately after phy_chans.

> diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
> index 9b803c0aec254..d3e3c4cd43f17 100644
> --- a/drivers/dma/ste_dma40.c
> +++ b/drivers/dma/ste_dma40.c

[ ... ]

> @@ -3197,10 +3198,9 @@ static int __init d40_hw_detect_init(struct platform_device *pdev,
>  		 "hardware rev: %d with %d physical and %d logical channels\n",
>  		 rev, num_phy_chans, num_log_chans);
>  
> -	base = devm_kzalloc(dev,
> -		ALIGN(sizeof(struct d40_base), 4) +
> -		(num_phy_chans + num_log_chans + num_memcpy_chans) *
> -		sizeof(struct d40_chan), GFP_KERNEL);
> +	alloc_size = struct_size(base, phy_chans, num_phy_chans);
> +	alloc_size += sizeof(*base->log_chans) * (num_log_chans + num_memcpy_chans);

[Severity: High]
Can this unchecked addition defeat the saturation arithmetic of struct_size()
and lead to a heap buffer overflow?

If struct_size() detects an overflow and saturates to SIZE_MAX, this
unconditional addition will wrap alloc_size around to a small integer value.

As a result, devm_kzalloc() might succeed in allocating an undersized buffer,
causing an out-of-bounds write when the channels are later initialized or
accessed.

Since phy_chans, log_chans, and memcpy_chans all use the same type and are
allocated contiguously, should the counts be summed inside a single
struct_size() call like this:

    alloc_size = struct_size(base, phy_chans,
                             num_phy_chans + num_log_chans + num_memcpy_chans);

Alternatively, the size_add() and size_mul() macros could be used to preserve
the saturation protection.

> +	base = devm_kzalloc(dev, alloc_size, GFP_KERNEL);
>  
>  	if (!base)
>  		return -ENOMEM;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260527203126.7053-1-rosenp@gmail.com?part=1