Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] dma: integer overflow in dma_dev_coherent_size() --
commit c7a3821680bbb5546ff7e7a9e6fe376429788c67 Author: Francesco Valla <[email protected]> dma-coherent: add base and size APIs This commit adds two new APIs, dma_dev_coherent_size() and dma_dev_coherent_base(), to retrieve the size and base address of the coherent memory pool associated with a device. > diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c > index 45bbae947f4be..f4aa5813604b8 100644 > --- a/kernel/dma/coherent.c > +++ b/kernel/dma/coherent.c [ ... ] > @@ -277,6 +277,40 @@ int dma_mmap_from_dev_coherent(struct device *dev, > struct vm_area_struct *vma, [ ... ] > +size_t dma_dev_coherent_size(struct device *dev) > +{ > + struct dma_coherent_mem *mem = dev_get_coherent_memory(dev); > + > + if (!mem) > + return 0; > + > + return (mem->size << PAGE_SHIFT); [Severity: High] Could this left shift overflow for large coherent pools? If the pool size is 2GB or larger, mem->size (which is an int representing the number of pages) will be >= 524288. Shifting a signed 32-bit integer by PAGE_SHIFT overflows in this case, and the result incorrectly sign-extends when implicitly cast to size_t. This might cause the function to return an astronomically large size_t value instead of the actual pool size, which could lead to out-of-bounds accesses or allocation failures in callers trusting the returned size. Would casting mem->size to size_t before the shift prevent this? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
