Re: [PATCH v2 1/2] dmaengine: loongson1: reject zero-length sg requests in prep_slave_sg

[Frank Li]

On Tue, Nov 03, 2026 at 04:46:37PM +0800, Li Ximo wrote:
> From: Wang Haoran <haoranwangsec@xxxxxxxxx>
>
> dmaengine_prep_slave_sg() forwards an sg_len of 0 to the driver
> unmodified. ls1x_dma_prep_slave_sg() does not reject it, and
> ls1x_dma_prep_lli() then builds no LLIs (the for_each_sg() loop body
> never executes) yet still returns success, producing a descriptor with
> an empty lli_list that is queued as a valid transfer.
>
> Reject sg_len == 0 requests early; a zero-length transfer is meaningless
> anyway.
>
> This issue was found by static analysis.
>
> Reported-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
> Reported-by: Li Ximo <lixicaicai@xxxxxxxxx>
> Signed-off-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
> ---

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

> v1: https://lore.kernel.org/r/20261026115113.3359939-1-lixicaicai@xxxxxxxxx
> v2: split the two independent fixes into separate patches as requested
> by Frank Li; no code change.
>
>  drivers/dma/loongson/loongson1-apb-dma.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/dma/loongson/loongson1-apb-dma.c b/drivers/dma/loongson/loongson1-apb-dma.c
> index 89786cbd2..e7eb40584 100644
> --- a/drivers/dma/loongson/loongson1-apb-dma.c
> +++ b/drivers/dma/loongson/loongson1-apb-dma.c
> @@ -302,6 +302,9 @@ ls1x_dma_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
>  	dev_dbg(chan2dev(dchan), "sg_len=%u flags=0x%lx dir=%s\n",
>  		sg_len, flags, dmaengine_get_direction_text(dir));
>
> +	if (!sg_len)
> +		return NULL;
> +
>  	desc = ls1x_dma_alloc_desc();
>  	if (!desc)
>  		return NULL;
> --
> 2.30.2