On Fri, Jan 09, 2026 at 10:28:24AM -0500, Frank Li wrote:
> dw_edma_channel_setup() calculates ll_max based on the size of the
> ll_region, but the value is later overwritten with -1, preventing the
> code from ever reaching the calculated ll_max.
>
> Typically ll_max is around 170 for a 4 KB page and four DMA R/W channels.
> It is uncommon for a single DMA request to reach this limit, so the issue
> has not been observed in practice. However, if it occurs, the driver may
> overwrite adjacent memory before reporting an error.
>
> Remove the incorrect assignment so the calculated ll_max is honored
>
> Fixes: 31fb8c1ff962d ("dmaengine: dw-edma: Improve the linked list and data
> blocks definition")
> Signed-off-by: Frank Li <[email protected]>
> ---
> drivers/dma/dw-edma/dw-edma-core.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/dma/dw-edma/dw-edma-core.c
> b/drivers/dma/dw-edma/dw-edma-core.c
> index
> c6b014949afe82f10362711fc8a956fe60a72835..b154bdd7f2897d9a28df698a425afc1b1c93698b
> 100644
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c
> @@ -770,7 +770,6 @@ static int dw_edma_channel_setup(struct dw_edma *dw, u32
> wr_alloc, u32 rd_alloc)
> chan->ll_max = (chip->ll_region_wr[chan->id].sz /
> EDMA_LL_SZ);
> else
> chan->ll_max = (chip->ll_region_rd[chan->id].sz /
> EDMA_LL_SZ);
> - chan->ll_max -= 1;
Just curious: wasn't this to reserve one slot for the final link element?
Best regards,
Koichiro
>
> dev_vdbg(dev, "L. List:\tChannel %s[%u] max_cnt=%u\n",
> str_write_read(chan->dir == EDMA_DIR_WRITE),
>
> --
> 2.34.1
>
