Patch "Avoid hw_desc array overrun in dw-axi-dmac" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Avoid hw_desc array overrun in dw-axi-dmac

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     avoid-hw_desc-array-overrun-in-dw-axi-dmac.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 587f6bf1d2366c5c42e632800815261389b65ebb
Author: Joao Pinto <Joao.Pinto@xxxxxxxxxxxx>
Date:   Wed Mar 27 10:49:24 2024 +0000

    Avoid hw_desc array overrun in dw-axi-dmac
    
    [ Upstream commit 333e11bf47fa8d477db90e2900b1ed3c9ae9b697 ]
    
    I have a use case where nr_buffers = 3 and in which each descriptor is composed by 3
    segments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put()
    handles the hw_desc considering the descs_allocated, this scenario would result in a
    kernel panic (hw_desc array will be overrun).
    
    To fix this, the proposal is to add a new member to the axi_dma_desc structure,
    where we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in
    axi_desc_put() to handle the hw_desc array correctly.
    
    Additionally I propose to remove the axi_chan_start_first_queued() call after completing
    the transfer, since it was identified that unbalance can occur (started descriptors can
    be interrupted and transfer ignored due to DMA channel not being enabled).
    
    Signed-off-by: Joao Pinto <jpinto@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/1711536564-12919-1-git-send-email-jpinto@xxxxxxxxxxxx
    Signed-off-by: Vinod Koul <vkoul@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
index cfc47efcb5d93..6715ade391aa1 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -213,6 +213,7 @@ static struct axi_dma_desc *axi_desc_alloc(u32 num)
 		kfree(desc);
 		return NULL;
 	}
+	desc->nr_hw_descs = num;
 
 	return desc;
 }
@@ -239,7 +240,7 @@ static struct axi_dma_lli *axi_desc_get(struct axi_dma_chan *chan,
 static void axi_desc_put(struct axi_dma_desc *desc)
 {
 	struct axi_dma_chan *chan = desc->chan;
-	int count = atomic_read(&chan->descs_allocated);
+	int count = desc->nr_hw_descs;
 	struct axi_dma_hw_desc *hw_desc;
 	int descs_put;
 
@@ -1049,9 +1050,6 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan)
 		/* Remove the completed descriptor from issued list before completing */
 		list_del(&vd->node);
 		vchan_cookie_complete(vd);
-
-		/* Submit queued descriptors after processing the completed ones */
-		axi_chan_start_first_queued(chan);
 	}
 
 out:
diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac.h b/drivers/dma/dw-axi-dmac/dw-axi-dmac.h
index 380005afde160..58fc6310ee364 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac.h
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac.h
@@ -101,6 +101,7 @@ struct axi_dma_desc {
 	u32				completed_blocks;
 	u32				length;
 	u32				period_len;
+	u32				nr_hw_descs;
 };
 
 static inline struct device *dchan2dev(struct dma_chan *dchan)