[PATCH v2 1/2] dmaengine: loongson1: reject zero-length sg requests in prep_slave_sg

[PATCH v2 1/2] dmaengine: loongson1: reject zero-length sg requests in prep_slave_sg

[Li Ximo]

From: Wang Haoran <haoranwangsec@gmail.com>

dmaengine_prep_slave_sg() forwards an sg_len of 0 to the driver
unmodified. ls1x_dma_prep_slave_sg() does not reject it, and
ls1x_dma_prep_lli() then builds no LLIs (the for_each_sg() loop body
never executes) yet still returns success, producing a descriptor with
an empty lli_list that is queued as a valid transfer.

Reject sg_len == 0 requests early; a zero-length transfer is meaningless
anyway.

This issue was found by static analysis.

Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
---
v1: https://lore.kernel.org/r/20261026115113.3359939-1-lixicaicai@gmail.com
v2: split the two independent fixes into separate patches as requested
by Frank Li; no code change.

 drivers/dma/loongson/loongson1-apb-dma.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/dma/loongson/loongson1-apb-dma.c b/drivers/dma/loongson/loongson1-apb-dma.c
index 89786cbd2..e7eb40584 100644
--- a/drivers/dma/loongson/loongson1-apb-dma.c
+++ b/drivers/dma/loongson/loongson1-apb-dma.c
@@ -302,6 +302,9 @@ ls1x_dma_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
 	dev_dbg(chan2dev(dchan), "sg_len=%u flags=0x%lx dir=%s\n",
 		sg_len, flags, dmaengine_get_direction_text(dir));
 
+	if (!sg_len)
+		return NULL;
+
 	desc = ls1x_dma_alloc_desc();
 	if (!desc)
 		return NULL;
-- 
2.30.2

[PATCH v2 2/2] dmaengine: loongson1: guard issue_pending against empty lli_list

[Li Ximo]

From: Wang Haoran <haoranwangsec@gmail.com>

ls1x_dma_issue_pending() calls list_first_entry(&desc->lli_list, ...)
without checking whether the list is empty. list_first_entry() does not
return NULL for an empty list; it returns the container_of() of the list
head pointer, i.e. a wild pointer into the enclosing
struct ls1x_dma_desc/virt_dma_desc area. The bogus &lli->phys is then
passed to ls1x_dma_start(), which dereferences it (out-of-bounds read)
and programs the DMA controller with the garbage address.

Switch to list_first_entry_or_null() with a NULL check so an empty
lli_list can never reach the hardware programming path. The companion
patch rejects the known producer of such descriptors (sg_len == 0 in
ls1x_dma_prep_slave_sg()); this guard covers any remaining path.

This issue was found by static analysis.

Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
---
v1: https://lore.kernel.org/r/20261026115113.3359939-1-lixicaicai@gmail.com
v2: split the two independent fixes into separate patches as requested
by Frank Li; no code change.

 drivers/dma/loongson/loongson1-apb-dma.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/loongson/loongson1-apb-dma.c b/drivers/dma/loongson/loongson1-apb-dma.c
index 89786cbd2..e7eb40584 100644
--- a/drivers/dma/loongson/loongson1-apb-dma.c
+++ b/drivers/dma/loongson/loongson1-apb-dma.c
@@ -478,8 +481,11 @@ static void ls1x_dma_issue_pending(struct dma_chan *dchan)
 			struct ls1x_dma_desc *desc = to_ls1x_dma_desc(vd);
 			struct ls1x_dma_lli *lli;
 
-			lli = list_first_entry(&desc->lli_list,
-					       struct ls1x_dma_lli, node);
+			lli = list_first_entry_or_null(&desc->lli_list,
+						       struct ls1x_dma_lli, node);
+			if (!lli)
+				return;
+
 			ls1x_dma_start(chan, &lli->phys);
 		}
 	}
-- 
2.30.2

Re: [PATCH v2 2/2] dmaengine: loongson1: guard issue_pending against empty lli_list

[Frank Li]

On Tue, Nov 03, 2026 at 04:46:38PM +0800, Li Ximo wrote:
> From: Wang Haoran <haoranwangsec@gmail.com>
>
> ls1x_dma_issue_pending() calls list_first_entry(&desc->lli_list, ...)

list_first_entry()

> without checking whether the list is empty. list_first_entry() does not
> return NULL for an empty list; it returns the container_of() of the list
> head pointer, i.e. a wild pointer into the enclosing
> struct ls1x_dma_desc/virt_dma_desc area.

> The bogus &lli->phys is then
> passed to ls1x_dma_start(), which dereferences it (out-of-bounds read)
> and programs the DMA controller with the garbage address.
>

Cut this paragraph

> Switch to list_first_entry_or_null() with a NULL check so an empty
> lli_list can never reach the hardware programming path.

> The companion
> patch rejects the known producer of such descriptors (sg_len == 0 in
> ls1x_dma_prep_slave_sg()); this guard covers any remaining path.

Cut this paragraph.

This common issue about list_first_entry(). Keep commit message simple
and leave important informaiton.

Frank

>
> This issue was found by static analysis.
>
> Reported-by: Wang Haoran <haoranwangsec@gmail.com>
> Reported-by: Li Ximo <lixicaicai@gmail.com>
> Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
> ---
> v1: https://lore.kernel.org/r/20261026115113.3359939-1-lixicaicai@gmail.com
> v2: split the two independent fixes into separate patches as requested
> by Frank Li; no code change.
>
>  drivers/dma/loongson/loongson1-apb-dma.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/dma/loongson/loongson1-apb-dma.c b/drivers/dma/loongson/loongson1-apb-dma.c
> index 89786cbd2..e7eb40584 100644
> --- a/drivers/dma/loongson/loongson1-apb-dma.c
> +++ b/drivers/dma/loongson/loongson1-apb-dma.c
> @@ -478,8 +481,11 @@ static void ls1x_dma_issue_pending(struct dma_chan *dchan)
>  			struct ls1x_dma_desc *desc = to_ls1x_dma_desc(vd);
>  			struct ls1x_dma_lli *lli;
>
> -			lli = list_first_entry(&desc->lli_list,
> -					       struct ls1x_dma_lli, node);
> +			lli = list_first_entry_or_null(&desc->lli_list,
> +						       struct ls1x_dma_lli, node);
> +			if (!lli)
> +				return;
> +
>  			ls1x_dma_start(chan, &lli->phys);
>  		}
>  	}
> --
> 2.30.2

Re: [PATCH v2 1/2] dmaengine: loongson1: reject zero-length sg requests in prep_slave_sg

[Frank Li]

On Tue, Nov 03, 2026 at 04:46:37PM +0800, Li Ximo wrote:
> From: Wang Haoran <haoranwangsec@gmail.com>
>
> dmaengine_prep_slave_sg() forwards an sg_len of 0 to the driver
> unmodified. ls1x_dma_prep_slave_sg() does not reject it, and
> ls1x_dma_prep_lli() then builds no LLIs (the for_each_sg() loop body
> never executes) yet still returns success, producing a descriptor with
> an empty lli_list that is queued as a valid transfer.
>
> Reject sg_len == 0 requests early; a zero-length transfer is meaningless
> anyway.
>
> This issue was found by static analysis.
>
> Reported-by: Wang Haoran <haoranwangsec@gmail.com>
> Reported-by: Li Ximo <lixicaicai@gmail.com>
> Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> v1: https://lore.kernel.org/r/20261026115113.3359939-1-lixicaicai@gmail.com
> v2: split the two independent fixes into separate patches as requested
> by Frank Li; no code change.
>
>  drivers/dma/loongson/loongson1-apb-dma.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/dma/loongson/loongson1-apb-dma.c b/drivers/dma/loongson/loongson1-apb-dma.c
> index 89786cbd2..e7eb40584 100644
> --- a/drivers/dma/loongson/loongson1-apb-dma.c
> +++ b/drivers/dma/loongson/loongson1-apb-dma.c
> @@ -302,6 +302,9 @@ ls1x_dma_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
>  	dev_dbg(chan2dev(dchan), "sg_len=%u flags=0x%lx dir=%s\n",
>  		sg_len, flags, dmaengine_get_direction_text(dir));
>
> +	if (!sg_len)
> +		return NULL;
> +
>  	desc = ls1x_dma_alloc_desc();
>  	if (!desc)
>  		return NULL;
> --
> 2.30.2