axi_rw_burst_len allowed values range is 1..256. Then this value goes to ARLEN/AWLEN 8-bit fields of lli->ctl_hi. So writing 256 leads to overflow and overwrites another fields in LLI. More over ARLEN/AWLEN are zero based (0 - 1, 256 - 255). Fixes: c454d16a7d5a ("dmaengine: dw-axi-dmac: Burst length settings") Signed-off-by: Maxim Kochetkov <fido_max@xxxxxxxx> --- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c index b23536645ff7..9aa79e9b49ca 100644 --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c @@ -1437,7 +1437,7 @@ static int parse_device_properties(struct axi_dma_chip *chip) return -EINVAL; chip->dw->hdata->restrict_axi_burst_len = true; - chip->dw->hdata->axi_rw_burst_len = tmp; + chip->dw->hdata->axi_rw_burst_len = tmp - 1; } return 0; @@ -1550,7 +1550,7 @@ static int dw_probe(struct platform_device *pdev) dma_cap_set(DMA_CYCLIC, dw->dma.cap_mask); /* DMA capabilities */ - dw->dma.max_burst = hdata->axi_rw_burst_len; + dw->dma.max_burst = hdata->axi_rw_burst_len + 1; dw->dma.src_addr_widths = AXI_DMA_BUSWIDTHS; dw->dma.dst_addr_widths = AXI_DMA_BUSWIDTHS; dw->dma.directions = BIT(DMA_MEM_TO_MEM); -- 2.45.2