[PATCH] staging: axis-fifo: validate tx_fifo_depth from device tree

[Ivy Lopez]

tx_fifo_depth is read from the "xlnx,tx-fifo-depth" device tree
property with no lower-bound check. It is later used in
axis_fifo_write() as (fifo->tx_fifo_depth - 4), an unsigned
subtraction, to bound the size of writes accepted from userspace.
If tx_fifo_depth is less than 4, this subtraction underflows,
defeating the check that exists specifically to prevent a
'Transmit Packet Overrun Error' requiring a reset of the TX
circuit to recover.

Reject tx_fifo_depth values below 4 at parse time, consistent
with the existing validation of the tdata-width properties in
the same function.

Signed-off-by: Ivy Lopez <skunkolee@xxxxxxxxx>
---
 drivers/staging/axis-fifo/axis-fifo.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
index 3aa2aa870ea9..66845f919375 100644
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
@@ -413,6 +413,8 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo)
 				   &fifo->tx_fifo_depth);
 	if (ret)
 		return ret;
+	if (fifo->tx_fifo_depth < 4)
+		return -EINVAL;
 
 	ret = of_property_read_u32(node, "xlnx,use-rx-data",
 				   &fifo->has_rx_fifo);
-- 
2.55.0