[PATCH] dmaengine: xilinx: dpdma: Fix crash on zero-length cyclic transfer

[Li Ximo]

From: Wang Haoran <haoranwangsec@xxxxxxxxx>

list_first_entry() does not return NULL when the list is empty; it
returns the result of container_of() on the list head, i.e. a wild
pointer rather than a valid entry. This was found by code audit.

In xilinx_dpdma_chan_prep_cyclic(), periods is computed as
buf_len / period_len. When buf_len is 0, the wrapper
xilinx_dpdma_prep_dma_cyclic() does not reject the request: it only
checks buf_len % period_len, and 0 % period_len == 0 passes. The
build loop then never executes, leaving tx_desc->descriptors empty
and 'last' still NULL. The unconditional list_first_entry() on the
empty list returns a wild pointer, and the immediately following
last->hw.next_desc write dereferences NULL, so a zero-length cyclic
request leads to a near-guaranteed kernel oops (plus an out-of-bounds
read of sw_desc->dma_addr through the wild pointer).

Bail out through the existing error path (freeing the tx descriptor
and returning NULL) when the descriptor list is still empty after the
build loop. A non-empty list also implies that the loop ran at least
once, so 'last' is guaranteed to be valid as well.

Reported-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
Reported-by: Li Ximo <lixicaicai@xxxxxxxxx>
Signed-off-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
---
 drivers/dma/xilinx/xilinx_dpdma.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/dma/xilinx/xilinx_dpdma.c b/drivers/dma/xilinx/xilinx_dpdma.c
index d9a3542c4..bdfa85b80 100644
--- a/drivers/dma/xilinx/xilinx_dpdma.c
+++ b/drivers/dma/xilinx/xilinx_dpdma.c
@@ -730,6 +730,9 @@ xilinx_dpdma_chan_prep_cyclic(struct xilinx_dpdma_chan *chan,
 		last = sw_desc;
 	}
 
+	if (list_empty(&tx_desc->descriptors))
+		goto error;
+
 	sw_desc = list_first_entry(&tx_desc->descriptors,
 				   struct xilinx_dpdma_sw_desc, node);
 	last->hw.next_desc = lower_32_bits(sw_desc->dma_addr);
-- 
2.30.2