Re: [PATCH] dmaengine: xilinx: dpdma: Fix crash on zero-length cyclic transfer

[Frank Li]

On Fri, Oct 23, 2026 at 02:59:00PM +0800, Li Ximo wrote:
> From: Wang Haoran <haoranwangsec@xxxxxxxxx>
>
> list_first_entry() does not return NULL when the list is empty; it
> returns the result of container_of() on the list head, i.e. a wild
> pointer rather than a valid entry. This was found by code audit.
>
> In xilinx_dpdma_chan_prep_cyclic(), periods is computed as
> buf_len / period_len. When buf_len is 0, the wrapper
> xilinx_dpdma_prep_dma_cyclic() does not reject the request: it only
> checks buf_len % period_len, and 0 % period_len == 0 passes. The
> build loop then never executes, leaving tx_desc->descriptors empty
> and 'last' still NULL. The unconditional list_first_entry() on the
> empty list returns a wild pointer, and the immediately following
> last->hw.next_desc write dereferences NULL, so a zero-length cyclic
> request leads to a near-guaranteed kernel oops (plus an out-of-bounds
> read of sw_desc->dma_addr through the wild pointer).
>
> Bail out through the existing error path (freeing the tx descriptor
> and returning NULL) when the descriptor list is still empty after the
> build loop. A non-empty list also implies that the loop ran at least
> once, so 'last' is guaranteed to be valid as well.

Can you use simple words to descript this problem

dmaengine: xilinx: dpdma: fix crash on zero-length cyclic transfer

When buf_len is zero, the descriptor build loop never runs, leaving the
descriptor list empty. The following list_first_entry() on the empty list
returns a bad pointer and causes a kernel oops.

Return NULL if the descriptor list is empty after the loop.

Frank

>
> Reported-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
> Reported-by: Li Ximo <lixicaicai@xxxxxxxxx>
> Signed-off-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
> ---
>  drivers/dma/xilinx/xilinx_dpdma.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/dma/xilinx/xilinx_dpdma.c b/drivers/dma/xilinx/xilinx_dpdma.c
> index d9a3542c4..bdfa85b80 100644
> --- a/drivers/dma/xilinx/xilinx_dpdma.c
> +++ b/drivers/dma/xilinx/xilinx_dpdma.c
> @@ -730,6 +730,9 @@ xilinx_dpdma_chan_prep_cyclic(struct xilinx_dpdma_chan *chan,
>  		last = sw_desc;
>  	}
>
> +	if (list_empty(&tx_desc->descriptors))
> +		goto error;
> +
>  	sw_desc = list_first_entry(&tx_desc->descriptors,
>  				   struct xilinx_dpdma_sw_desc, node);
>  	last->hw.next_desc = lower_32_bits(sw_desc->dma_addr);
> --
> 2.30.2
>