Re: [PATCH v5 17/17] dmaengine: sh: rz-dmac: Set the Link End (LE) bit on the last descriptor

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing bounds check on `sg_len` in `rz_dmac_prep_slave_sg()` leading to hardware descriptor ring overwrite and silent data corruption.
--

commit a98e7dbe1a1cc544a92a491414810a97272d12ae
Author: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>

dmaengine: sh: rz-dmac: Set the Link End (LE) bit on the last descriptor

This commit modifies the RZ/G2L DMA driver to set the Link End (LE) bit
on the last descriptor of a transfer. This informs the DMA engine that
the transfer is finished, preventing it from loading invalid descriptors
and halting without raising an interrupt.

> diff --git a/drivers/dma/sh/rz-dmac.c b/drivers/dma/sh/rz-dmac.c
> --- a/drivers/dma/sh/rz-dmac.c
> +++ b/drivers/dma/sh/rz-dmac.c

[ ... ]

> @@ -425,7 +426,7 @@ static void rz_dmac_prepare_descs_for_slave_sg(struct rz_dmac_chan *channel)
>  		lmdesc->chext = 0;
>  		if (i == (sg_len - 1)) {
>  			lmdesc->chcfg = (channel->chcfg & ~CHCFG_DEM);
> -			lmdesc->header = HEADER_LV;
> +			lmdesc->header = HEADER_LV | HEADER_LE;
>  		} else {
>  			lmdesc->chcfg = channel->chcfg;
>  			lmdesc->header = HEADER_LV;

Does this code safely handle scatterlists that are larger than the hardware
descriptor ring?

If a DMA client submits a scatterlist with more than DMAC_NR_LMDESC (64)
segments, the initialization loop wraps around and overwrites the beginning
of the descriptor ring:

    if (++lmdesc >= (channel->lmdesc.base + DMAC_NR_LMDESC))
            lmdesc = channel->lmdesc.base;

Because this update unconditionally applies the HEADER_LE bit to the final
segment (i == sg_len - 1), an oversized scatterlist would cause the last
overwritten descriptor to receive the HEADER_LE bit.

When the DMA engine starts, it executes the first few overwritten segments
and prematurely halts when it encounters the misplaced Link End bit, dropping
the rest of the segments without raising an error.

Should rz_dmac_prep_slave_sg() check for sg_len > DMAC_NR_LMDESC and return
NULL to avoid data corruption, similar to how rz_dmac_prep_dma_cyclic()
explicitly checks if periods is greater than DMAC_NR_LMDESC?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260512121219.216159-1-claudiu.beznea.uj@bp.renesas.com?part=17