Re: [PATCH 2/2] dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access

[Jia Wang]

On 2026-08-28 10:01 +0300, Andy Shevchenko wrote:
> On Fri, Aug 28, 2026 at 08:48:27AM +0800, Jia Wang wrote:
> > axi_chan_list_dump_lli() uses the channel-wide descs_allocated count to
> > walk the hw_desc[] array of a single transaction. If multiple
> > transactions have allocated LLIs, the channel count can exceed the
> > transaction-local nr_hw_descs and make the DMA error path read past the
> > end of hw_desc[].
> > 
> > Use the descriptor-local nr_hw_descs count when dumping LLIs.
> 
> ...
> 
> >  {
> > -	int count = atomic_read(&chan->descs_allocated);
> >  	int i;
> >  
> > -	for (i = 0; i < count; i++)
> > +	for (i = 0; i < desc_head->nr_hw_descs; i++)
> 
> While at it,
> 
> 	for (unsigned int i = 0; i < desc_head->nr_hw_descs; i++)
> 
> and drop that 'int i;' as well.
> 

Will update it in v2, thanks.

> >  		axi_chan_dump_lli(chan, &desc_head->hw_desc[i]);
> >  }
> 
> -- 
> With Best Regards,
> Andy Shevchenko
> 
> 
> 

Best regards,
Jia Wang