Re: [PATCH] staging: axis-fifo: fix underflow of tx_fifo_depth in size check

[Greg KH]

On Tue, Sep 01, 2026 at 08:31:41AM +0530, Manush Prajwal wrote:
> axis_fifo_write() bounds a transmit by checking:
> 
>     words_to_write > (fifo->tx_fifo_depth - 4)
> 
> fifo->tx_fifo_depth is an unsigned int populated directly from the
> devicetree property "xlnx,tx-fifo-depth" in axis_fifo_parse_dt(),
> with no lower-bound validation. If a devicetree ever supplies a
> tx-fifo-depth smaller than 4 (e.g. a malformed or misconfigured DT),
> "tx_fifo_depth - 4" underflows, wrapping to a huge value. The size
> check above then never triggers, silently defeating the exact
> overrun protection the surrounding comment describes: writes far
> larger than the FIFO's real capacity get accepted and passed to the
> hardware, driving it into the "Transmit Packet Overrun Error"
> condition the check exists to prevent.

So this is just a bug in the device tree?

How was this found and tested?

> Validate tx_fifo_depth against the minimum the driver requires at
> devicetree-parse time, matching the existing validation style already
> used in axis_fifo_parse_dt() for the other DT properties.
> 
> Signed-off-by: Manush Prajwal <manushprajwal555@xxxxxxxxx>
> ---
>  drivers/staging/axis-fifo/axis-fifo.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
> index 3d358f9193523c..dba76fbf5d685a 100644
> --- a/drivers/staging/axis-fifo/axis-fifo.c
> +++ b/drivers/staging/axis-fifo/axis-fifo.c
> @@ -412,6 +412,13 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo)
>  				   &fifo->tx_fifo_depth);
>  	if (ret)
>  		return ret;
> +	/*
> +	 * axis_fifo_write() computes 'tx_fifo_depth - 4' to bound the size of
> +	 * a transmit; a depth smaller than that underflows the unsigned
> +	 * subtraction and silently disables the overrun check.
> +	 */

Did you forget to add an Assisted-by: tag for this patch?

thanks,

greg k-h