From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 06EB41D9A70 for ; Fri, 31 Jul 2026 00:01:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785456115; cv=none; b=qAXFAHkRdWtxfPoDsHkYLCdqN4a7lcKpvlUco/V6OTlMMocOYsBSbQgiSMTUnix/ACsKn7JjMM4hw9StNCbaur9jgnK+NtUTFHcLHajp3vmfWg2huOzAc0YEtgyCMWseKeCfqFW6gD4GETbuYywCzzXLVIgAsV0R/toobVX93Wg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785456115; c=relaxed/simple; bh=9ZRwQjPCaizQ4bN+gZRfSXmYVFs2bqgBTDrFloTFsnc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=h+UbL3xvBJkVHfwJoyVAJxtxNOmB5aKHb2UB6qh0hM0afWQ97D+bcH0hp1GtThOp0W/yu9JnC2r4luLk6QHDRaze6ySZDm4hxdSd7ryNUK265wyLzBXQ/ngsV6F2PXi8x6UoDP2oyvnwimD7C9N0EwdkVWX3OFP9qRh7Xd30JSI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=d2yAlqzT; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="d2yAlqzT" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so4605875ad.1 for ; Thu, 30 Jul 2026 17:01:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785456113; x=1786060913; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=nE9dZ9awcdUrGQCJeMJn5hlWnAUsMViLR5JL6xcAB4k=; b=d2yAlqzTcmeWMVwi+AFEGS6nWDVmZEuCrqFe3VW0j1UK0iR6OJo4yLAkqul5FTn4gy eYzi+CIwPz975xIJY5lMu2N77qWf06s3zti4E2K5zOcbjJ1NK+zP+j3KeUTU9ccB6ft8 N3ULP6PBGOrd+Z3MpHbdPx8DJvDzt6jthIMWgM++FQC2tI0p6Jrq0MgMpuRsD7dvzTb6 UNR8hBAuVBnVMgo3CnJymJt3JrnuX5oZqzwwoLyXdp2ykrDnQw8hAQ/pu+OdddhvVy8B 3ZM8wU/C5HLkfycktEP1+B8XeO9WnlL1GESO8FG7mS3h0TXlnzttkDlLJsMnIL4ceJWl GBHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785456113; x=1786060913; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nE9dZ9awcdUrGQCJeMJn5hlWnAUsMViLR5JL6xcAB4k=; b=YMhZM5RjVQrsP0bMdhuoxSdTHJu42A6qUmPKcrbXrnP5EwNowQAQiElT7rYmE0vzy7 HtdpoyynN/tA3b6ZiG7afWX+36ugdqtl+Q18hf2LJytZL/Ggvz0P4RTGPudHVMxVaxzk j+yvOLCITWTjbEOfmrUY8uQwlXgcviuqvATOnzwvdbgU5RMM8dyKPdM0iCYMq3zAiOUD u/IPTbgmHoueDLNn+qodt4BUBxtFzajIwtTnT4TM5w92s+AnM8VoT7NVlKJi9KohZmJN 61B7WFLM7HYUHh6WvSlaO5uki30ZNPlxI7oRK0+7YZuWhclY6bdWma3C9/2NRqIRv3fL OI8w== X-Forwarded-Encrypted: i=1; AHgh+Rq29NTy6cQG1G6+LzdrNViZSlgXVgwXdEfqqHCiFip24CX+EnZijU9FeF6n1pZR0V5HOL/x2y+hU3ibOF4=@vger.kernel.org X-Gm-Message-State: AOJu0YzMaleOS8096MvAg2BNOeuz+4b41WydgCZes7uY1G9L76ke++ER khrLld6tEkwVN5iBmdQWYBGW0Bvip9VTjIogXG+IbdTvk+agNGjgRs/K X-Gm-Gg: AR+sD13XXy28yISKyUbjipqA4HiUsETh31imvwKWMp2QXknDe28JLkTPnGvjMTOLVRd DduceMczvqOU0fJ+cTepPJvD0JNfhJzNdJiBAdeDN48rkOXs2dIjOB33Cu8THIE+IPsEra9TdWD Y3OeCxD7Iy/LOVjri7H7xs7m7As8uBTiQ1viVkHbxfrBewYWwM3Zy7jMCoPL669VdcWdLYuUGjX HZsXMcmxvcW6HJNLYb/JaDf6hLWeliJWOabJ2Kj+UefUJq1wZ7XUxXEcSGtKvEWgetgpWFUZR4W +AZKrEDNk7YBbKUIkyU1dYwm8o66Dq7RD8BQwmgf40Hf9FVGmKt5HNFhrChwkajJA+fOXznkiL6 WfrqXzNQFF24m7jcg1KUOeH8NKsSXDtgyEHRj2Ck+sDxrZ1ieJZDXG54H2yRHTXR+KwQUNNkd8Q dZxxevJvgxSj5CduIrhcksW+nK2Q5OugExeThKC39LvLVX5FzknC8c7A8KGjBridSX+lEWR2jMM rIe+t65+HQf5sVS/Br6mhD4XYyldCOdvtPT0Lbnqcmtx2gtulGvMiGoda4qutwYnXyq40Pz X-Received: by 2002:a17:902:f60f:b0:2ce:e75f:b713 with SMTP id d9443c01a7336-2d046e8688cmr128935ad.23.1785456113179; Thu, 30 Jul 2026 17:01:53 -0700 (PDT) Received: from bloom.localdomain ([2604:3d09:178e:e100::6868]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d022bf39cdsm33069015ad.55.2026.07.30.17.01.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Jul 2026 17:01:52 -0700 (PDT) From: Ivy Lopez To: Greg Kroah-Hartman Cc: Ovidiu Panait , linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Ivy Lopez Subject: [PATCH] staging: axis-fifo: validate tx_fifo_depth from device tree Date: Thu, 30 Jul 2026 18:01:36 -0600 Message-ID: <20260731000136.96707-1-skunkolee@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit tx_fifo_depth is read from the "xlnx,tx-fifo-depth" device tree property with no lower-bound check. It is later used in axis_fifo_write() as (fifo->tx_fifo_depth - 4), an unsigned subtraction, to bound the size of writes accepted from userspace. If tx_fifo_depth is less than 4, this subtraction underflows, defeating the check that exists specifically to prevent a 'Transmit Packet Overrun Error' requiring a reset of the TX circuit to recover. Reject tx_fifo_depth values below 4 at parse time, consistent with the existing validation of the tdata-width properties in the same function. Signed-off-by: Ivy Lopez --- drivers/staging/axis-fifo/axis-fifo.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c index 3aa2aa870ea9..66845f919375 100644 --- a/drivers/staging/axis-fifo/axis-fifo.c +++ b/drivers/staging/axis-fifo/axis-fifo.c @@ -413,6 +413,8 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo) &fifo->tx_fifo_depth); if (ret) return ret; + if (fifo->tx_fifo_depth < 4) + return -EINVAL; ret = of_property_read_u32(node, "xlnx,use-rx-data", &fifo->has_rx_fifo); -- 2.55.0