From nobody Sun Sep 27 00:36:54 2026 Received: from ultrarisc.com (unknown [218.76.62.146]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 9D5EB30FF36; Fri, 28 Aug 2026 00:48:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=218.76.62.146 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787878118; cv=none; b=PObJ1QiL2twJVqVk1zTYJ+o+wSHD0bI+F1VaKrKBD2MEN0re+8eNglu+4olDcBxa5q845PgKPDxecHqBnzfSamHfT3Wo7UhepA2Hijrq6V0E/bHdfRovCEZesEEP/tCY/xL4AQB5HtaObSTMHQg4okfjm+yCE0OQfU08nouzqPs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787878118; c=relaxed/simple; bh=NFLyLX8R+hoLKXzujgGCXVP5FlVDAWB3PS2BC0v4nNw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=XWvwQ9grlt7BNWlLQxpU8GtGC19dhZiwJH4qyAepqBDx7AJ0/bLxHZ3xleCjRwFLPLeROv8Ouwv4cT7nuMOmI2CkcElUvOe1HL5Ai6BY74yeh67ahk8z5nUl8dPER5NPZbhdlHG+lKgja44fF7PC0Gtrf9BDg3L6BRCo6TOX0FI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ultrarisc.com; spf=none smtp.mailfrom=ultrarisc.com; dkim=pass (1024-bit key) header.d=ultrarisc.com header.i=@ultrarisc.com header.b=j1H+YKhB; arc=none smtp.client-ip=218.76.62.146 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ultrarisc.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=ultrarisc.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=ultrarisc.com header.i=@ultrarisc.com header.b="j1H+YKhB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ultrarisc.com; s=dkim; h=Received:From:Date:Subject: MIME-Version:Content-Type:Content-Transfer-Encoding:Message-Id: References:In-Reply-To:To:Cc; bh=zvPKw/e7U23JjWvrITW/LvPufCKRBKh 4C3l1JjoU0P8=; b=j1H+YKhB8RO5ZUCKUiEE8DQgG6Frjs5vSH10bUEWKBoKd1z XCy/HuiXDMLfhNRS6urR8zUchQrZJTWWbQ5phls6o4peBw91hloSRWlLUhfxBe14 Vyw4azk6JMlWSGTBEnEbL/L8R7uBokyVCXZIBjyUeoT4zuMZ5ntte+KkvWxE= Received: from [127.0.0.1] (unknown [192.168.100.1]) by localhost.localdomain (Coremail) with SMTP id AQAAfwCXxs3p2pBqHmMBAA--.589S3; Fri, 28 Aug 2026 08:48:41 +0800 (CST) From: Jia Wang Date: Fri, 28 Aug 2026 08:48:26 +0800 Subject: [PATCH 1/2] dmaengine: dw-axi-dmac: Fix AXI burst length encoding Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260828-dma-fix-v1-1-a6947f487e07@ultrarisc.com> References: <20260828-dma-fix-v1-0-a6947f487e07@ultrarisc.com> In-Reply-To: <20260828-dma-fix-v1-0-a6947f487e07@ultrarisc.com> To: Eugeniy Paltsev , Vinod Koul , Frank Li , Pandith N , Andy Shevchenko , Sia Jee Heng Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org, Jia Wang X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1787878108; l=1873; i=wangjia@ultrarisc.com; s=20260515; h=from:subject:message-id; bh=NFLyLX8R+hoLKXzujgGCXVP5FlVDAWB3PS2BC0v4nNw=; b=Zt2qIgkd3e4H4DIydk17FYZHA0O0uUHtPcoFArqoI59OBP9Qk2bd928XGLmSudDxXrQYm7dBg 9Squ8fN6sQbDA2+j2Wi0CCGJh35W9k3VSKmA9QJ7ni9O/giQviRYvWf X-Developer-Key: i=wangjia@ultrarisc.com; a=ed25519; pk=wGVm18siRScehKOkOz0WKxgxDy7IezHEszhnN4/TUCY= X-CM-TRANSID: AQAAfwCXxs3p2pBqHmMBAA--.589S3 X-Coremail-Antispam: 1UD129KBjvJXoW7ZF1rKryfZFy7CFy3tr1fJFb_yoW8Cw4Upa n5Kw4rJryDtw1qka1kJ347ZFyUtFy5KrWIvF48Zw1SkFZ8X34Svr4kKw1F9r1kAF4rJr4f tF4fJFyrZF1kZrDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPI14x267AKxVW5JVWrJwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jr4l82xGYIkIc2 x26xkF7I0E14v26r1I6r4UM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1l84 ACjcxK6I8E87Iv67AKxVWUJVW8JwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UM2AI xVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj6xIIjxv20x vE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xv r2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7MxkF7I0En4kS14v26r1q6r43Mx kIecxEwVCm-wCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02 F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GF ylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7Cj xVAFwI0_Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r 1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JUq kskUUUUU= X-CM-SenderInfo: pzdqwylld63zxwud2x1vfou0bp/1tbiAQAMEWqPrHsAIwAJsE The snps,axi-max-burst-len property describes the number of beats in an AXI burst, while the ARLEN and AWLEN fields encode that value minus one. The driver keeps axi_rw_burst_len as the actual burst length so that dma_device.max_burst reports the correct value. However, it also programs that unencoded value directly into the hardware fields. A value of 256 therefore overflows the 8-bit fields and can cause AXI decode errors. Subtract one only when constructing hardware descriptors, while keeping the actual value for dma_device.max_burst. Fixes: c454d16a7d5a ("dmaengine: dw-axi-dmac: Burst length settings") Signed-off-by: Jia Wang Reviewed-by: Frank Li --- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/d= w-axi-dmac/dw-axi-dmac-platform.c index eebed2474210..742e08cfab43 100644 --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c @@ -706,7 +706,7 @@ static int dw_axi_dma_set_hw_desc(struct axi_dma_chan *= chan, ctlhi =3D CH_CTL_H_LLI_VALID; =20 if (chan->chip->dw->hdata->restrict_axi_burst_len) { - burst_len =3D chan->chip->dw->hdata->axi_rw_burst_len; + burst_len =3D chan->chip->dw->hdata->axi_rw_burst_len - 1; ctlhi |=3D CH_CTL_H_ARLEN_EN | CH_CTL_H_AWLEN_EN | burst_len << CH_CTL_H_ARLEN_POS | burst_len << CH_CTL_H_AWLEN_POS; @@ -975,7 +975,7 @@ dma_chan_prep_dma_memcpy(struct dma_chan *dchan, dma_ad= dr_t dst_adr, =20 reg =3D CH_CTL_H_LLI_VALID; if (chan->chip->dw->hdata->restrict_axi_burst_len) { - u32 burst_len =3D chan->chip->dw->hdata->axi_rw_burst_len; + u32 burst_len =3D chan->chip->dw->hdata->axi_rw_burst_len - 1; =20 reg |=3D (CH_CTL_H_ARLEN_EN | burst_len << CH_CTL_H_ARLEN_POS | --=20 2.34.1 From nobody Sun Sep 27 00:36:54 2026 Received: from ultrarisc.com (unknown [218.76.62.146]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 9D57230675F; Fri, 28 Aug 2026 00:48:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=218.76.62.146 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787878118; cv=none; b=SxR4QStwgEAo/xS+rOP172jJHaEAwA7+PDK8wVSMmRfXLW9DJigdWN02gnzUxve91RHOFGKXs74UlB60Pvkx/zxtgK2LJb5C2m9RlcH0nK9LB6c4/DTIQh3EUJJHyvmL0wsmbBoKEXvSdyKiwQeRiLmo2Kn9+319ytHEJv1h7MI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787878118; c=relaxed/simple; bh=qUf0tWnWOEng5OgNjM4mCzyydn/KQZFJkgi8w/3pzgU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=aNakV/5Rh6o/utVJoRZjAYj4MI+RWwqBXp1iL9bzeQhh3Uwi+/JCzjuKRvoqF5rrEJC5lh5H0TNAlcNrqsI+hQd9tPaW7hCq3NrYUOCRgreavM9DvjnPQWcQzMHZX6uf0OnCaoUJhyIW34qi/r/vYMOjr26sJIqXjLntxfPg/ns= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ultrarisc.com; spf=none smtp.mailfrom=ultrarisc.com; dkim=pass (1024-bit key) header.d=ultrarisc.com header.i=@ultrarisc.com header.b=PU0rKjk5; arc=none smtp.client-ip=218.76.62.146 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ultrarisc.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=ultrarisc.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=ultrarisc.com header.i=@ultrarisc.com header.b="PU0rKjk5" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ultrarisc.com; s=dkim; h=Received:From:Date:Subject: MIME-Version:Content-Type:Content-Transfer-Encoding:Message-Id: References:In-Reply-To:To:Cc; bh=GRoYM0brQmdDMaezx5bJq85ueyTx++t 7ZvC1Q3nljbs=; b=PU0rKjk5i67WH3IXaeKvCGibRRZnQrBBiXprosuAEA/wjLI 83AXrxT0TRHgIh+6Xclttae0BmKU1WiKbHk4YXzDh5S0xLsMj7DSjBh8BKge983I vObS8r9ZamgF17lqXDQvMDfaSz7jkfKwwMhWpkLZANN7vtVPs3FeccQ0OsFE= Received: from [127.0.0.1] (unknown [192.168.100.1]) by localhost.localdomain (Coremail) with SMTP id AQAAfwCXxs3p2pBqHmMBAA--.589S4; Fri, 28 Aug 2026 08:48:42 +0800 (CST) From: Jia Wang Date: Fri, 28 Aug 2026 08:48:27 +0800 Subject: [PATCH 2/2] dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260828-dma-fix-v1-2-a6947f487e07@ultrarisc.com> References: <20260828-dma-fix-v1-0-a6947f487e07@ultrarisc.com> In-Reply-To: <20260828-dma-fix-v1-0-a6947f487e07@ultrarisc.com> To: Eugeniy Paltsev , Vinod Koul , Frank Li , Pandith N , Andy Shevchenko , Sia Jee Heng Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org, Jia Wang X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1787878108; l=1273; i=wangjia@ultrarisc.com; s=20260515; h=from:subject:message-id; bh=qUf0tWnWOEng5OgNjM4mCzyydn/KQZFJkgi8w/3pzgU=; b=yupluAKKaBvidmMIoR4wP/PiWMt6s5ZFVuYaGwVEF9CA0cM8d8HF++PDSXte2RkHA6arRgybm p6mXz08zXGEC0b9NP/Qtbrzc+dqSGciP18ksREA9RLqrd+EcewZdoRb X-Developer-Key: i=wangjia@ultrarisc.com; a=ed25519; pk=wGVm18siRScehKOkOz0WKxgxDy7IezHEszhnN4/TUCY= X-CM-TRANSID: AQAAfwCXxs3p2pBqHmMBAA--.589S4 X-Coremail-Antispam: 1UD129KBjvJXoW7WF4fAw13ZrWUWr4ktw1fWFg_yoW8Jw15pF W5J3yxZryrKF9xJay8Xw47CrW5JayUXFWIvw4jy34SvasaqrsYv3WDK3WFkF1DGF95ZF42 yF4jk34fZF47ZrDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPI14x267AKxVWrJVCq3wAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jryl82xGYIkIc2 x26xkF7I0E14v26r4j6ryUM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1l84 ACjcxK6I8E87Iv67AKxVWUJVW8JwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UM2AI xVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj6xIIjxv20x vE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xv r2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7MxkF7I0En4kS14v26r1q6r43Mx kIecxEwVCm-wCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02 F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GF ylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7Cj xVAFwI0_Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r 1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JUc zV8UUUUU= X-CM-SenderInfo: pzdqwylld63zxwud2x1vfou0bp/1tbiAQAMEWqPrHsAIwAMsB axi_chan_list_dump_lli() uses the channel-wide descs_allocated count to walk the hw_desc[] array of a single transaction. If multiple transactions have allocated LLIs, the channel count can exceed the transaction-local nr_hw_descs and make the DMA error path read past the end of hw_desc[]. Use the descriptor-local nr_hw_descs count when dumping LLIs. Fixes: ef6fb2d6f1ab ("dmaengine: dw-axi-dmac: simplify descriptor managemen= t") Signed-off-by: Jia Wang --- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/d= w-axi-dmac/dw-axi-dmac-platform.c index 742e08cfab43..858004b5a846 100644 --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c @@ -1052,10 +1052,9 @@ static void axi_chan_dump_lli(struct axi_dma_chan *c= han, static void axi_chan_list_dump_lli(struct axi_dma_chan *chan, struct axi_dma_desc *desc_head) { - int count =3D atomic_read(&chan->descs_allocated); int i; =20 - for (i =3D 0; i < count; i++) + for (i =3D 0; i < desc_head->nr_hw_descs; i++) axi_chan_dump_lli(chan, &desc_head->hw_desc[i]); } =20 --=20 2.34.1