Re: [PATCH v6 2/9] dmaengine: dma-axi-dmac: Use bus width capability helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] dmaengine: axi-dmac: copy_align assigned literal byte width instead of log2
--

commit 42cec2a379cf13fe7096c3154a7c87e99d4f9258
Author: Nuno Sá <nuno.sa@analog.com>

dmaengine: dma-axi-dmac: Use bus width capability helpers

Advertise the source and destination bus widths through the new
dmaengine_bus_width_set() helper instead of open-coding the legacy
BIT() mask. This moves the driver onto the representation that can
express widths of 32 bytes and above while keeping the legacy u32 fields
populated during the transition.

> diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
> index d47ff27e1408f..ab436e9d6cbc3 100644
> --- a/drivers/dma/dma-axi-dmac.c
> +++ b/drivers/dma/dma-axi-dmac.c
> @@ -1262,8 +1262,13 @@ static int axi_dmac_probe(struct platform_device *pdev)
>  	dma_dev->device_terminate_all = axi_dmac_terminate_all;
>  	dma_dev->device_synchronize = axi_dmac_synchronize;
>  	dma_dev->dev = &pdev->dev;
> -	dma_dev->src_addr_widths = BIT(dmac->chan.src_width);
> -	dma_dev->dst_addr_widths = BIT(dmac->chan.dest_width);
> +	ret = dmaengine_bus_width_set(&dma_dev->src_bus_widths, dmac->chan.src_width);
> +	if (ret)
> +		return ret;
> +
> +	ret = dmaengine_bus_width_set(&dma_dev->dst_bus_widths, dmac->chan.dest_width);
> +	if (ret)
> +		return ret;

[Severity: High]
Does this change cause undefined behavior when enabling 32-byte and larger bus
widths?

The field copy_align expects an enum dmaengine_alignment (which represents the
base-2 logarithm of the alignment), but it gets assigned a literal byte width
further down in axi_dmac_probe():

drivers/dma/dma-axi-dmac.c:axi_dmac_probe() {
    ...
	dma_dev->copy_align = (dmac->chan.address_align_mask + 1);
    ...
}

Any caller invoking dmaengine_check_align() (e.g. via is_dma_copy_aligned() in
dmatest or async_tx) will then perform a bit shift that can exceed the width
of a 32-bit integer:

include/linux/dmaengine.h:dmaengine_check_align() {
    ...
	return !(((1 << align) - 1) & (off1 | off2 | len));
    ...
}

If align is 32 or more, 1 << align results in undefined behavior because the
shift exponent is too large. This typically results in a 0 mask, accepting all
unaligned addresses and potentially leading to DMA hardware faults.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014-dmaengine-support-wider-dma-masks-v6-0-5b3ffdef8191@analog.com?part=2