diff options
| author | Jia Wang <wangjia@ultrarisc.com> | 2026-09-02 17:26:12 +0800 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-09-10 19:27:22 +0530 |
| commit | e6b49f8016ee8b642e8e495d1704342ee0b35d72 (patch) | |
| tree | 63888efe7e27e6a5fbae37eb026c631fd6738fd6 | |
| parent | 0d59891c42e11c3840276d8a632dbc355d6ddc4f (diff) | |
| download | linux-next-e6b49f8016ee8b642e8e495d1704342ee0b35d72.tar.gz linux-next-e6b49f8016ee8b642e8e495d1704342ee0b35d72.zip | |
dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access
axi_chan_list_dump_lli() uses the channel-wide descs_allocated count to
walk the hw_desc[] array of a single transaction. If multiple
transactions have allocated LLIs, the channel count can exceed the
transaction-local nr_hw_descs and make the DMA error path read past the
end of hw_desc[].
Use the descriptor-local nr_hw_descs count when dumping LLIs.
Fixes: ef6fb2d6f1ab ("dmaengine: dw-axi-dmac: simplify descriptor management")
Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260902-dma-fix-v3-2-414c6449fbcc@ultrarisc.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
| -rw-r--r-- | drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c index ea26ebc328bc..2d7d49017002 100644 --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c @@ -1052,10 +1052,7 @@ static void axi_chan_dump_lli(struct axi_dma_chan *chan, static void axi_chan_list_dump_lli(struct axi_dma_chan *chan, struct axi_dma_desc *desc_head) { - int count = atomic_read(&chan->descs_allocated); - int i; - - for (i = 0; i < count; i++) + for (unsigned int i = 0; i < desc_head->nr_hw_descs; i++) axi_chan_dump_lli(chan, &desc_head->hw_desc[i]); } |