Claude review: accel/ethosu: fix integer overflow in dma_length()

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: accel/ethosu: fix integer overflow in dma_length()
Author: Muhammad Bilal <meatuni001@gmail.com>
Patches: 3
Reviewed: 2026-05-25T17:08:43.686509

---

This mbox contains three versions (v1, v2, v3) of the same patch fixing arithmetic issues in `dma_length()` in the Arm Ethos-U NPU accelerator driver. Only v3 should be considered for merging — v1 and v2 are superseded.

The core issue is real and security-relevant: user-supplied command stream values feed into unchecked arithmetic that computes `region_size[]`, which is later used as a bounds check against GEM buffer sizes. Integer wraparound can underreport the true DMA region usage, allowing the NPU hardware to access memory outside the allocated GEM buffer.

The v3 patch correctly addresses four arithmetic hazards: negative stride underflow, multiplication overflow, `len + offset` overflow, and the missing caller validation of the `U64_MAX` error sentinel. The fix is well-scoped and uses the standard kernel overflow helpers (`check_mul_overflow`, `check_add_overflow`).

One observation for a possible follow-up: the same `addr + 1` addition at `ethosu_gem.c:240` in `feat_matrix_length()`, and the `base + length` additions at lines 291–293 and 303–305 in `calc_sizes()`, have no overflow protection either. These are analogous to the `len + offset` overflow that v3 fixed in `dma_length()`.

---

---
Generated by Claude Code Patch Reviewer