Re: [PATCH 2/2] dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access

[Andy Shevchenko]

On Fri, Aug 28, 2026 at 08:48:27AM +0800, Jia Wang wrote:
> axi_chan_list_dump_lli() uses the channel-wide descs_allocated count to
> walk the hw_desc[] array of a single transaction. If multiple
> transactions have allocated LLIs, the channel count can exceed the
> transaction-local nr_hw_descs and make the DMA error path read past the
> end of hw_desc[].
> 
> Use the descriptor-local nr_hw_descs count when dumping LLIs.

...

>  {
> -	int count = atomic_read(&chan->descs_allocated);
>  	int i;
>  
> -	for (i = 0; i < count; i++)
> +	for (i = 0; i < desc_head->nr_hw_descs; i++)

While at it,

	for (unsigned int i = 0; i < desc_head->nr_hw_descs; i++)

and drop that 'int i;' as well.

>  		axi_chan_dump_lli(chan, &desc_head->hw_desc[i]);
>  }

-- 
With Best Regards,
Andy Shevchenko