Re: [PATCH v8 6/7] xen/serial: harden serial_tx_buffer checks

On 10.08.2026 22:32, Stefano Stabellini wrote:
> On Mon, 27 Jul 2026, [email protected] wrote:
>> --- a/xen/drivers/char/serial.c
>> +++ b/xen/drivers/char/serial.c
>> @@ -523,6 +523,8 @@ void __init serial_async_transmit(struct serial_port *port)
>>          return;
>>      if ( serial_txbufsz < PAGE_SIZE )
>>          serial_txbufsz = PAGE_SIZE;
>> +    if ( serial_txbufsz > GB(2) )
>> +        serial_txbufsz = CONFIG_SERIAL_TX_BUFSIZE;
>>      while ( serial_txbufsz & (serial_txbufsz - 1) )
>>          serial_txbufsz &= serial_txbufsz - 1;
> 
> My understanding of this loop is that, given that serial_txbufsz is
> unsigned int, it is already clamping it to 2GB max

It would, yes, as long as sizeof(unsigned int) == sizeof(uint32_t). While
we certainly have many instances of that assumption in the code, I think
we're well advised to avoid adding more.

Furthermore (see related comments on patch 5) one may raise the question
whether serial_txbufsz wouldn't better be of type size_t.

What I'm uncertain about is the resetting to CONFIG_SERIAL_TX_BUFSIZE
here: When an overly huge size was requested, shouldn't we give the
biggest we permit?

Jan