Re: [PATCH v2 6/9] iio: buffer-dmaengine: Use dma_slave_caps bus width accessors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] DMA buffer alignment calculation uses `round_down()` with non-power-of-2 alignments, causing broken truncation
--

--- Patch [6]: [PATCH v2 6/9] iio: buffer-dmaengine: Use dma_slave_caps bus width accessors ---
commit 5f03b0a586d9a871f77efec877e70d9047e60575
Author: Nuno Sá <nuno.sa@analog.com>

iio: buffer-dmaengine: Use dma_slave_caps bus width accessors

This commit updates the IIO DMA buffer to use the new dma_slave_caps
bus width helpers instead of decoding raw legacy width masks. This ensures
compatibility with DMA controllers using the new bitmap representation.

> diff --git a/drivers/iio/buffer/industrialio-buffer-dmaengine.c b/drivers/iio/buffer/industrialio-buffer-dmaengine.c
> index 98acce9098547..855e3662cd3dc 100644
> --- a/drivers/iio/buffer/industrialio-buffer-dmaengine.c
> +++ b/drivers/iio/buffer/industrialio-buffer-dmaengine.c
> @@ -229,14 +229,13 @@ static struct iio_buffer *iio_dmaengine_buffer_alloc(struct dma_chan *chan)
>  		return ERR_PTR(-ENOMEM);
>  
>  	/* Needs to be aligned to the maximum of the minimums */
> -	if (caps.src_addr_widths)
> -		src_width = __ffs(caps.src_addr_widths);
> -	else
> -		src_width = 1;
> -	if (caps.dst_addr_widths)
> -		dest_width = __ffs(caps.dst_addr_widths);
> -	else
> -		dest_width = 1;
> +	src_width = dma_slave_caps_get_src_width_min(&caps);
> +	if (src_width == DMA_SLAVE_BUSWIDTH_UNDEFINED)
> +		src_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
> +	dest_width = dma_slave_caps_get_dst_width_min(&caps);
> +	if (dest_width == DMA_SLAVE_BUSWIDTH_UNDEFINED)
> +		dest_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
> +
>  	width = max(src_width, dest_width);

[Severity: High]
This is a pre-existing issue, but does this alignment calculation
cause broken truncation when used with 3-byte bus widths?

If a DMA controller advertises a 3-byte minimum bus width
(e.g., using 24-bit transfers), width and subsequently
dmaengine_buffer->align will be set to 3.

In iio_dmaengine_buffer_submit_block(), this alignment is used:

    max_size = round_down(max_size, dmaengine_buffer->align);

The round_down(x, y) macro requires y to be a power of 2 because it
evaluates to (x & ~(y - 1)). When align is 3, round_down(max_size, 3) 
yields (max_size & ~2) instead of properly rounding to a multiple of 3.

For example, round_down(30, 3) evaluates to 28 instead of 27. 

This incorrectly aligned length is then assigned to block->bytes_used 
and passed to the DMA controller, which could result in unaligned 
transfer configurations and DMA controller faults.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260810-dmaengine-support-wider-dma-masks-v2-0-1f7b798d035f@analog.com?part=6