Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <2f1d4e18-f377-74c1-59fc-da422d4e99ee@quicinc.com>
Date:   Sat, 24 Jun 2023 10:06:07 -0600
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.6.0
Subject: Re: [PATCH 10/26] bus: mhi: host: use array_size
Content-Language: en-US
To:     Kees Cook <keescook@chromium.org>
CC:     Julia Lawall <julia.lawall@inria.fr>,
        Manivannan Sadhasivam <mani@kernel.org>,
        <kernel-janitors@vger.kernel.org>, <mhi@lists.linux.dev>,
        <linux-arm-msm@vger.kernel.org>, <linux-kernel@vger.kernel.org>
References: <20230623211457.102544-1-Julia.Lawall@inria.fr>
 <20230623211457.102544-11-Julia.Lawall@inria.fr>
 <3b4ff79b-93b4-cf56-1488-113905b3981d@quicinc.com>
 <alpine.DEB.2.22.394.2306232340510.3129@hadrien>
 <58cb3bf6-5ffd-194b-1455-4e5bb045fc34@quicinc.com>
 <202306231639.68955384A@keescook>
From:   Jeffrey Hugo <quic_jhugo@quicinc.com>
In-Reply-To: <202306231639.68955384A@keescook>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 6/23/2023 5:45 PM, Kees Cook wrote:
> On Fri, Jun 23, 2023 at 04:09:46PM -0600, Jeffrey Hugo wrote:
>> Kees, would you please chime in and educate me here?  I feel like I'm
>> missing something important here.
> 
> The array_size() family will saturate at SIZE_MAX (rather than potentially
> wrapping around). No allocator can fulfil a 18446744073709551615 byte
> (18 exabyte) allocation. :) So the NULL return value will (hopefully)
> trigger an error path.
> 

Fair enough, that handles the 64-bit usecase.  I'm guessing the 
assumption is that on a 32-bit usecase where size_t is ~4GB, there won't 
actually be 4GB to allocate and things will also fail.  So far, so good.

What about a 32-bit system with something like ARM's LPAE (Large 
Physical Address Extension) where the host is 32-bit, and so size_t 
would be ~4GB (as far as I can tell) but phys_addr_t is larger than 
that, and so we can have/access more than 4GB of resources?  Lets see, 
ignoring that its a 13 year old feature and probably not in circulation 
anymore, probably still can't satisfy a 4GB allocation since you'd need 
to map all of it to address it, and part of the address space is surely 
reserved for other things.

Ok, I think I'm convinced.  I'm going to sleep on it, but I suspect all 
will still be good early next week.

Thank you for the explanation.

-Jeff