Re: [PATCH v13 02/12] iio: kstrtox: add local _parse_integer_limit_init() helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] Removal of a critical safety warning from the `_parse_integer_limit` documentation creates a trap for out-of-bounds memory access.
- [Low] Incorrect subsystem prefix 'iio:' for a core library patch.
--

commit 3edc3198f402bbf5139ee03843cbee9aeeecb619
Author: Rodrigo Alencar <rodrigo.alencar@analog.com>

iio: kstrtox: add local _parse_integer_limit_init() helper

This patch introduces _parse_integer_limit_init() to accept an initial
accumulated value for parsing 64-bit integers. It updates
_parse_integer_limit() to use this new helper with an initial value of 0,
and reorganizes its documentation.

> iio: kstrtox: add local _parse_integer_limit_init() helper

This isn't a bug, but since this patch modifies lib/kstrtox.c, which is a core
library file, should the prefix be "lib:" or "lib/kstrtox:" instead of "iio:"?

> diff --git a/lib/kstrtox.c b/lib/kstrtox.c
> index 97be2a39f5371..0705461f51c04 100644
> --- a/lib/kstrtox.c
> +++ b/lib/kstrtox.c

[ ... ]

> -/*
> - * Convert non-negative integer string representation in explicitly given radix
> - * to an integer. A maximum of max_chars characters will be converted.
> - *
> - * Return number of characters consumed maybe or-ed with overflow bit.
> - * If overflow occurs, result integer (incorrect) is still returned.
> - *
> - * Don't you dare use this function.
> - */
> -noinline
> -unsigned int _parse_integer_limit(const char *s, unsigned int base, unsigned long long *p,
> -				  size_t max_chars)

[ ... ]

> +/**
> + * _parse_integer_limit() - Convert integer string representation to an integer
> + *			    limiting the number of characters parsed.
> + * @s: The start of the string.
> + * @base: The number base to use.
> + * @p: Where to write the result of the conversion.
> + * @max_chars: Maximum amount of characters to consume.
> + *
> + * Convert non-negative integer string representation in explicitly given radix
> + * to an integer. A maximum of max_chars characters will be converted.
> + *
> + * Return: Number of characters consumed maybe or-ed with overflow bit.
> + *	   If overflow occurs, result integer (incorrect) is still returned.
> + */
> +noinline
> +unsigned int _parse_integer_limit(const char *s, unsigned int base,
> +				  unsigned long long *p, size_t max_chars)

Is it safe to remove the "Don't you dare use this function." warning?

Since this function returns the number of consumed characters bitwise-ORed with
the KSTRTOX_OVERFLOW flag, turning the comment into standard kernel-doc format
makes it look like an inviting API.

If a developer uses this and directly advances a pointer by the return value
without masking the overflow bit, could an integer overflow during parsing cause
the pointer to jump out-of-bounds?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260517-adf41513-iio-driver-v13-0-bb6e134a360f@analog.com?part=2