On Mon, Aug 17, 2026 at 10:44:33PM +0200, Sascha Hauer wrote:
> pxad_alloc_desc() was converted from
>
> kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT)
>
> to kzalloc_flex(), which sets the __counted_by() counter sw_desc->nb_desc
> itself - but only where the compiler has __builtin_counted_by_ref(), so
> from gcc 15.1 or clang 22.1 on. The loop below it still increments
> nb_desc, which makes it come out doubled there and correct elsewhere.
>
> nb_desc is what pxad_free_desc() iterates over and what
> set_updater_desc() indexes from, so set it explicitly and drop the
> increment. The error path has to lower it to the number of descriptors
> allocated so far, otherwise pxad_free_desc() would free entries that were
> never allocated.
>
> Fixes: 69050f8d6d075 ("treewide: Replace kmalloc with kmalloc_obj for
> non-scalar types")
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Sascha Hauer <[email protected]>
> ---
Reviewed-by: Frank Li <[email protected]>
> pxad_alloc_desc() was converted from
>
> kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT)
>
> to kzalloc_flex(). hw_desc[] is annotated with __counted_by(nb_desc), so
> __alloc_flex() now initializes sw_desc->nb_desc to nb_hw_desc itself.
> The loop below it still increments nb_desc for every descriptor it
> allocates though, so nb_desc ends up being twice the number of
> descriptors that are actually there.
>
> Drop the now redundant increment. The error path has to set nb_desc to
> the number of descriptors allocated so far, otherwise pxad_free_desc()
> would free entries that were never allocated.
> ---
> Changes in v2:
> - assign sw_desc->nb_desc manually as it is only automatically assigned
> for compilers supporting __builtin_counted_by_ref()
> - Link to v1:
> https://lore.kernel.org/r/[email protected]
> ---
> drivers/dma/pxa_dma.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
> index fa2ee0b3e09f8..fc43124fefa89 100644
> --- a/drivers/dma/pxa_dma.c
> +++ b/drivers/dma/pxa_dma.c
> @@ -744,6 +744,7 @@ pxad_alloc_desc(struct pxad_chan *chan, unsigned int
> nb_hw_desc)
> sw_desc = kzalloc_flex(*sw_desc, hw_desc, nb_hw_desc, GFP_NOWAIT);
> if (!sw_desc)
> return NULL;
> + sw_desc->nb_desc = nb_hw_desc;
> sw_desc->desc_pool = chan->desc_pool;
>
> for (i = 0; i < nb_hw_desc; i++) {
> @@ -752,10 +753,10 @@ pxad_alloc_desc(struct pxad_chan *chan, unsigned int
> nb_hw_desc)
> dev_err(&chan->vc.chan.dev->device,
> "%s(): Couldn't allocate the %dth hw_desc from
> dma_pool %p\n",
> __func__, i, sw_desc->desc_pool);
> + sw_desc->nb_desc = i;
> goto err;
> }
>
> - sw_desc->nb_desc++;
> sw_desc->hw_desc[i] = desc;
>
> if (i == 0)
>
> ---
> base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
> change-id: 20260817-dmaengine-pxa-64152bb34313
>
> Best regards,
> --
> Sascha Hauer <[email protected]>
>
