[PATCH v2] dmaengine: xilinx: dpdma: fix crash on zero-length cyclic transfer

[Li Ximo]

From: Wang Haoran <haoranwangsec@xxxxxxxxx>

When buf_len is zero, the descriptor build loop never runs, leaving the
descriptor list empty. The following list_first_entry() on the empty list
returns a bad pointer and causes a kernel oops.

Return NULL if the descriptor list is empty after the loop.

This issue was found by static analysis.

Reported-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
Reported-by: Li Ximo <lixicaicai@xxxxxxxxx>
Signed-off-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
---
v1: https://lore.kernel.org/r/20261023065900.3455414-1-lixicaicai@xxxxxxxxx
v2: rewrite the commit message in simpler words as suggested by Frank
Li; no code change.

 drivers/dma/xilinx/xilinx_dpdma.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/dma/xilinx/xilinx_dpdma.c b/drivers/dma/xilinx/xilinx_dpdma.c
index d9a3542c4..bdfa85b80 100644
--- a/drivers/dma/xilinx/xilinx_dpdma.c
+++ b/drivers/dma/xilinx/xilinx_dpdma.c
@@ -730,6 +730,9 @@ xilinx_dpdma_chan_prep_cyclic(struct xilinx_dpdma_chan *chan,
 		last = sw_desc;
 	}
 
+	if (list_empty(&tx_desc->descriptors))
+		goto error;
+
 	sw_desc = list_first_entry(&tx_desc->descriptors,
 				   struct xilinx_dpdma_sw_desc, node);
 	last->hw.next_desc = lower_32_bits(sw_desc->dma_addr);
-- 
2.30.2