[PATCH 2/5] dmaengine: xilinx_dma: Fix cyclic period count truncation

[Gupta, Suraj]

On 10/23/2026 3:41 AM, Jeff C. Jensen via B4 Relay wrote:
> From: "Jeff C. Jensen" <kernel at nullptr.com>
> 
> xilinx_dma_prep_dma_cyclic() stores buf_len / period_len, a size_t
> quotient, in an unsigned int. On 64-bit builds the count can be
> truncated: a buffer of 2^32 + 1 bytes split into 1-byte periods becomes
> a single period, and the transfer covers one byte of the buffer the
> client asked for.
> 
> Compute the quotient as a size_t and reject it if it exceeds
> XILINX_DMA_NUM_DESCS before narrowing it. Each period needs at least one
> hardware descriptor, so a larger count could never be prepared from the
> pool anyway.
> 
> Fixes: 92d794dfb699 ("dmaengine: vdma: Add support for cyclic dma mode")
> Assisted-by: Claude:claude-fable-5-1
> Signed-off-by: Jeff C. Jensen <kernel at nullptr.com>
> ---

Reviewed-by: Suraj Gupta <suraj.gupta2 at amd.com>

Thanks!
Suraj

>   drivers/dma/xilinx/xilinx_dma.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
> index 5ccc9f9d58a3..aa714effd10d 100644
> --- a/drivers/dma/xilinx/xilinx_dma.c
> +++ b/drivers/dma/xilinx/xilinx_dma.c
> @@ -2454,7 +2454,7 @@ static struct dma_async_tx_descriptor *xilinx_dma_prep_dma_cyclic(
>   	struct xilinx_dma_chan *chan = to_xilinx_chan(dchan);
>   	struct xilinx_dma_tx_descriptor *desc;
>   	struct xilinx_axidma_tx_segment *segment, *head_segment, *prev = NULL;
> -	size_t copy, sg_used;
> +	size_t copy, sg_used, periods;
>   	unsigned int num_periods;
>   	int i;
>   	u32 reg;
> @@ -2462,10 +2462,11 @@ static struct dma_async_tx_descriptor *xilinx_dma_prep_dma_cyclic(
>   	if (!period_len)
>   		return NULL;
>   
> -	num_periods = buf_len / period_len;
> -
> -	if (!num_periods)
> +	/* a period takes at least one descriptor */
> +	periods = buf_len / period_len;
> +	if (!periods || periods > XILINX_DMA_NUM_DESCS)
>   		return NULL;
> +	num_periods = periods;
>   
>   	if (!is_slave_direction(direction))
>   		return NULL;
>