From: Frank Li <Frank.Li@nxp.com>
To: "Manivannan Sadhasivam" <mani@kernel.org>,
"Vinod Koul" <vkoul@kernel.org>,
"Gustavo Pimentel" <Gustavo.Pimentel@synopsys.com>,
"Kees Cook" <kees@kernel.org>,
"Gustavo A. R. Silva" <gustavoars@kernel.org>,
"Krzysztof Wilczyński" <kwilczynski@kernel.org>,
"Kishon Vijay Abraham I" <kishon@kernel.org>,
"Bjorn Helgaas" <bhelgaas@google.com>,
"Christoph Hellwig" <hch@lst.de>,
"Niklas Cassel" <cassel@kernel.org>
Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-hardening@vger.kernel.org, linux-pci@vger.kernel.org,
linux-nvme@lists.infradead.org, imx@lists.linux.dev,
Frank Li <Frank.Li@nxp.com>
Subject: [PATCH v2 04/11] dmaengine: dw-edma: Remove ll_max = -1 in dw_edma_channel_setup()
Date: Fri, 09 Jan 2026 10:28:24 -0500 [thread overview]
Message-ID: <20260109-edma_ll-v2-4-5c0b27b2c664@nxp.com> (raw)
In-Reply-To: <20260109-edma_ll-v2-0-5c0b27b2c664@nxp.com>
dw_edma_channel_setup() calculates ll_max based on the size of the
ll_region, but the value is later overwritten with -1, preventing the
code from ever reaching the calculated ll_max.
Typically ll_max is around 170 for a 4 KB page and four DMA R/W channels.
It is uncommon for a single DMA request to reach this limit, so the issue
has not been observed in practice. However, if it occurs, the driver may
overwrite adjacent memory before reporting an error.
Remove the incorrect assignment so the calculated ll_max is honored
Fixes: 31fb8c1ff962d ("dmaengine: dw-edma: Improve the linked list and data blocks definition")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
drivers/dma/dw-edma/dw-edma-core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
index c6b014949afe82f10362711fc8a956fe60a72835..b154bdd7f2897d9a28df698a425afc1b1c93698b 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -770,7 +770,6 @@ static int dw_edma_channel_setup(struct dw_edma *dw, u32 wr_alloc, u32 rd_alloc)
chan->ll_max = (chip->ll_region_wr[chan->id].sz / EDMA_LL_SZ);
else
chan->ll_max = (chip->ll_region_rd[chan->id].sz / EDMA_LL_SZ);
- chan->ll_max -= 1;
dev_vdbg(dev, "L. List:\tChannel %s[%u] max_cnt=%u\n",
str_write_read(chan->dir == EDMA_DIR_WRITE),
--
2.34.1
next prev parent reply other threads:[~2026-01-09 15:29 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-09 15:28 [PATCH v2 00/11] dmaengine: dw-edma: flatten desc structions and simple code Frank Li
2026-01-09 15:28 ` [PATCH v2 01/11] dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK Frank Li
2026-02-25 8:26 ` Koichiro Den
2026-02-25 15:50 ` Frank Li
2026-02-26 2:22 ` Koichiro Den
2026-02-26 15:23 ` Frank Li
2026-02-27 6:29 ` Koichiro Den
2026-01-09 15:28 ` [PATCH v2 02/11] dmaengine: dw-edma: Move control field update of DMA link to the last step Frank Li
2026-01-09 15:28 ` [PATCH v2 03/11] dmaengine: dw-edma: Add xfer_sz field to struct dw_edma_chunk Frank Li
2026-01-09 15:28 ` Frank Li [this message]
2026-02-25 8:30 ` [PATCH v2 04/11] dmaengine: dw-edma: Remove ll_max = -1 in dw_edma_channel_setup() Koichiro Den
2026-02-25 15:43 ` Frank Li
2026-02-26 2:16 ` Koichiro Den
2026-02-26 15:21 ` Frank Li
2026-02-27 6:30 ` Koichiro Den
2026-01-09 15:28 ` [PATCH v2 05/11] dmaengine: dw-edma: Move ll_region from struct dw_edma_chunk to struct dw_edma_chan Frank Li
2026-01-09 15:28 ` [PATCH v2 06/11] dmaengine: dw-edma: Pass down dw_edma_chan to reduce one level of indirection Frank Li
2026-01-09 15:28 ` [PATCH v2 07/11] dmaengine: dw-edma: Add helper dw_(edma|hdma)_v0_core_ch_enable() Frank Li
2026-01-09 15:28 ` [PATCH v2 08/11] dmaengine: dw-edma: Add callbacks to fill link list entries Frank Li
2026-01-09 15:28 ` [PATCH v2 09/11] dmaengine: dw-edma: Use common dw_edma_core_start() for both eDMA and HDMA Frank Li
2026-01-09 15:28 ` [PATCH v2 10/11] dmaengine: dw-edma: Use burst array instead of linked list Frank Li
2026-01-09 15:28 ` [PATCH v2 11/11] dmaengine: dw-edma: Remove struct dw_edma_chunk Frank Li
2026-01-12 13:07 ` [PATCH v2 00/11] dmaengine: dw-edma: flatten desc structions and simple code Niklas Cassel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260109-edma_ll-v2-4-5c0b27b2c664@nxp.com \
--to=frank.li@nxp.com \
--cc=Gustavo.Pimentel@synopsys.com \
--cc=bhelgaas@google.com \
--cc=cassel@kernel.org \
--cc=dmaengine@vger.kernel.org \
--cc=gustavoars@kernel.org \
--cc=hch@lst.de \
--cc=imx@lists.linux.dev \
--cc=kees@kernel.org \
--cc=kishon@kernel.org \
--cc=kwilczynski@kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nvme@lists.infradead.org \
--cc=linux-pci@vger.kernel.org \
--cc=mani@kernel.org \
--cc=vkoul@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®