[PATCH] staging: axis-fifo: fix underflow of tx_fifo_depth in size check

[Manush Prajwal]

axis_fifo_write() bounds a transmit by checking:

    words_to_write > (fifo->tx_fifo_depth - 4)

fifo->tx_fifo_depth is an unsigned int populated directly from the
devicetree property "xlnx,tx-fifo-depth" in axis_fifo_parse_dt(),
with no lower-bound validation. If a devicetree ever supplies a
tx-fifo-depth smaller than 4 (e.g. a malformed or misconfigured DT),
"tx_fifo_depth - 4" underflows, wrapping to a huge value. The size
check above then never triggers, silently defeating the exact
overrun protection the surrounding comment describes: writes far
larger than the FIFO's real capacity get accepted and passed to the
hardware, driving it into the "Transmit Packet Overrun Error"
condition the check exists to prevent.

Validate tx_fifo_depth against the minimum the driver requires at
devicetree-parse time, matching the existing validation style already
used in axis_fifo_parse_dt() for the other DT properties.

Signed-off-by: Manush Prajwal <manushprajwal555@xxxxxxxxx>
---
 drivers/staging/axis-fifo/axis-fifo.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
index 3d358f9193523c..dba76fbf5d685a 100644
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
@@ -412,6 +412,13 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo)
 				   &fifo->tx_fifo_depth);
 	if (ret)
 		return ret;
+	/*
+	 * axis_fifo_write() computes 'tx_fifo_depth - 4' to bound the size of
+	 * a transmit; a depth smaller than that underflows the unsigned
+	 * subtraction and silently disables the overrun check.
+	 */
+	if (fifo->tx_fifo_depth < 4)
+		return -EINVAL;
 
 	ret = of_property_read_u32(node, "xlnx,use-rx-data",
 				   &fifo->has_rx_fifo);
--
2.43.0