Re: [PATCH 2/5] dmaengine: xilinx_dma: Fix cyclic period count truncation

[Frank Li]

On Thu, Oct 22, 2026 at 03:11:31PM -0700, Jeff C. Jensen wrote:
> xilinx_dma_prep_dma_cyclic() stores buf_len / period_len, a size_t
> quotient, in an unsigned int. On 64-bit builds the count can be
> truncated: a buffer of 2^32 + 1 bytes split into 1-byte periods becomes
> a single period, and the transfer covers one byte of the buffer the
> client asked for.
>
> Compute the quotient as a size_t and reject it if it exceeds
> XILINX_DMA_NUM_DESCS before narrowing it. Each period needs at least one
> hardware descriptor, so a larger count could never be prepared from the
> pool anyway.
>
> Fixes: 92d794dfb699 ("dmaengine: vdma: Add support for cyclic dma mode")
> Assisted-by: Claude:claude-fable-5-1
> Signed-off-by: Jeff C. Jensen <kernel@xxxxxxxxxxx>
> ---

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

>  drivers/dma/xilinx/xilinx_dma.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
> index 5ccc9f9d58a3..aa714effd10d 100644
> --- a/drivers/dma/xilinx/xilinx_dma.c
> +++ b/drivers/dma/xilinx/xilinx_dma.c
> @@ -2454,7 +2454,7 @@ static struct dma_async_tx_descriptor *xilinx_dma_prep_dma_cyclic(
>  	struct xilinx_dma_chan *chan = to_xilinx_chan(dchan);
>  	struct xilinx_dma_tx_descriptor *desc;
>  	struct xilinx_axidma_tx_segment *segment, *head_segment, *prev = NULL;
> -	size_t copy, sg_used;
> +	size_t copy, sg_used, periods;
>  	unsigned int num_periods;
>  	int i;
>  	u32 reg;
> @@ -2462,10 +2462,11 @@ static struct dma_async_tx_descriptor *xilinx_dma_prep_dma_cyclic(
>  	if (!period_len)
>  		return NULL;
>
> -	num_periods = buf_len / period_len;
> -
> -	if (!num_periods)
> +	/* a period takes at least one descriptor */
> +	periods = buf_len / period_len;
> +	if (!periods || periods > XILINX_DMA_NUM_DESCS)
>  		return NULL;
> +	num_periods = periods;
>
>  	if (!is_slave_direction(direction))
>  		return NULL;
>
> --
> 2.43.0
>