Re: [PATCHv2 1/2] dmaengine: idma64: use kzalloc_flex

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] If `idma64_prep_slave_sg()` is called with `sg_len == 0`, it eventually calls `idma64_desc_fill()` which accesses `desc->hw[UINT_MAX]`, causing a kernel panic.
--

--- Patch [1]: [PATCHv2 1/2] dmaengine: idma64: use kzalloc_flex ---
commit 54aec29a1bbe69497782adf915ba6169fd73e345
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: idma64: use kzalloc_flex

This commit refactors the idma64_desc and idma64 structures to use flexible
array members. It simplifies allocations by using kzalloc_flex and adds
__counted_by annotations for runtime bounds checking.

> diff --git a/drivers/dma/idma64.c b/drivers/dma/idma64.c
> index 5fcd1befc92da..d914f50ec3096 100644
> --- a/drivers/dma/idma64.c
> +++ b/drivers/dma/idma64.c
[ ... ]
> @@ -307,10 +289,12 @@ static struct dma_async_tx_descriptor *idma64_prep_slave_sg(
>  	struct scatterlist *sg;
>  	unsigned int i;
>  
> -	desc = idma64_alloc_desc(sg_len);
> +	desc = kzalloc_flex(*desc, hw, sg_len, GFP_NOWAIT);
>  	if (!desc)
>  		return NULL;
>  
> +	desc->ndesc = sg_len;
> +

[Severity: High]
This is a pre-existing issue, but can this lead to an out-of-bounds access
if idma64_prep_slave_sg() is called with sg_len == 0?

If sg_len is 0, desc->ndesc is set to 0 and the for_each_sg() loop is
bypassed. The function then calls idma64_desc_fill() which does the
following:

drivers/dma/idma64.c:idma64_desc_fill() {
    ...
    unsigned int i = desc->ndesc;
    struct idma64_hw_desc *hw = &desc->hw[i - 1];
    ...
}

Since i is 0, i - 1 underflows to UINT_MAX, causing an out-of-bounds
access on the hw flex array. With the new __counted_by bounds check,
this will likely trigger a panic immediately.

>  	for_each_sg(sgl, sg, sg_len, i) {
>  		struct idma64_hw_desc *hw = &desc->hw[i];
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260712220039.924958-2-rosenp@gmail.com?part=1