Re: [PATCH] staging: axis-fifo: fix underflow of tx_fifo_depth in size check

Re: [PATCH] staging: axis-fifo: fix underflow of tx_fifo_depth in size check

[Manush Prajwal]

On Tue, Sep 01, 2026 at 10:06:00AM +0530, Greg KH wrote:
> So this is just a bug in the device tree?
>
> How was this found and tested?

You're right, and I should have said this up front instead of making
you ask.

This was found by static source review with AI assistance (Claude),
not from a real fault report, fuzzing, or anything hit on actual
hardware. It was checked with checkpatch --strict and verified to
apply cleanly against a fresh clone, but it was never build-tested
against a real kernel build or run on axis-fifo hardware.

On reflection your first question is the real issue: tx-fifo-depth
comes from the devicetree, which is trusted input describing the
hardware, not attacker-controlled data crossing a security boundary.
A DT that lies about the FIFO depth is a bug in that DT, not
something the driver needs to defend against. I don't think this
patch is worth carrying -- happy to drop it.

> Did you forget to add an Assisted-by: tag for this patch?

Yes -- I should have disclosed the AI assistance in the commit
message itself rather than leaving it for you to notice and ask
about. Apologies for that, and thank you for calling it out
directly.

Manush

[PATCH] staging: axis-fifo: fix underflow of tx_fifo_depth in size check

[Manush Prajwal]

axis_fifo_write() bounds a transmit by checking:

    words_to_write > (fifo->tx_fifo_depth - 4)

fifo->tx_fifo_depth is an unsigned int populated directly from the
devicetree property "xlnx,tx-fifo-depth" in axis_fifo_parse_dt(),
with no lower-bound validation. If a devicetree ever supplies a
tx-fifo-depth smaller than 4 (e.g. a malformed or misconfigured DT),
"tx_fifo_depth - 4" underflows, wrapping to a huge value. The size
check above then never triggers, silently defeating the exact
overrun protection the surrounding comment describes: writes far
larger than the FIFO's real capacity get accepted and passed to the
hardware, driving it into the "Transmit Packet Overrun Error"
condition the check exists to prevent.

Validate tx_fifo_depth against the minimum the driver requires at
devicetree-parse time, matching the existing validation style already
used in axis_fifo_parse_dt() for the other DT properties.

Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com>
---
 drivers/staging/axis-fifo/axis-fifo.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
index 3d358f9193523c..dba76fbf5d685a 100644
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
@@ -412,6 +412,13 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo)
 				   &fifo->tx_fifo_depth);
 	if (ret)
 		return ret;
+	/*
+	 * axis_fifo_write() computes 'tx_fifo_depth - 4' to bound the size of
+	 * a transmit; a depth smaller than that underflows the unsigned
+	 * subtraction and silently disables the overrun check.
+	 */
+	if (fifo->tx_fifo_depth < 4)
+		return -EINVAL;
 
 	ret = of_property_read_u32(node, "xlnx,use-rx-data",
 				   &fifo->has_rx_fifo);
--
2.43.0

Re: [PATCH] staging: axis-fifo: fix underflow of tx_fifo_depth in size check

[Greg KH]

On Tue, Sep 01, 2026 at 08:31:41AM +0530, Manush Prajwal wrote:
> axis_fifo_write() bounds a transmit by checking:
> 
>     words_to_write > (fifo->tx_fifo_depth - 4)
> 
> fifo->tx_fifo_depth is an unsigned int populated directly from the
> devicetree property "xlnx,tx-fifo-depth" in axis_fifo_parse_dt(),
> with no lower-bound validation. If a devicetree ever supplies a
> tx-fifo-depth smaller than 4 (e.g. a malformed or misconfigured DT),
> "tx_fifo_depth - 4" underflows, wrapping to a huge value. The size
> check above then never triggers, silently defeating the exact
> overrun protection the surrounding comment describes: writes far
> larger than the FIFO's real capacity get accepted and passed to the
> hardware, driving it into the "Transmit Packet Overrun Error"
> condition the check exists to prevent.

So this is just a bug in the device tree?

How was this found and tested?

> Validate tx_fifo_depth against the minimum the driver requires at
> devicetree-parse time, matching the existing validation style already
> used in axis_fifo_parse_dt() for the other DT properties.
> 
> Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com>
> ---
>  drivers/staging/axis-fifo/axis-fifo.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
> index 3d358f9193523c..dba76fbf5d685a 100644
> --- a/drivers/staging/axis-fifo/axis-fifo.c
> +++ b/drivers/staging/axis-fifo/axis-fifo.c
> @@ -412,6 +412,13 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo)
>  				   &fifo->tx_fifo_depth);
>  	if (ret)
>  		return ret;
> +	/*
> +	 * axis_fifo_write() computes 'tx_fifo_depth - 4' to bound the size of
> +	 * a transmit; a depth smaller than that underflows the unsigned
> +	 * subtraction and silently disables the overrun check.
> +	 */

Did you forget to add an Assisted-by: tag for this patch?

thanks,

greg k-h