[PATCH] dmaengine: loongson1: fix list_first_entry on possibly empty lli_list

[PATCH] dmaengine: loongson1: fix list_first_entry on possibly empty lli_list

[Li Ximo]

From: Wang Haoran <haoranwangsec@gmail.com>

ls1x_dma_issue_pending() calls list_first_entry(&desc->lli_list, ...)
without checking whether the list is empty. list_first_entry() does not
return NULL for an empty list; it returns the container_of() of the list
head pointer, i.e. a wild pointer that points backwards into the
enclosing struct ls1x_dma_desc/virt_dma_desc area. The bogus &lli->phys
is then passed to ls1x_dma_start(), which dereferences it (out-of-bounds
read) and programs the DMA controller with the garbage address.

The list can indeed be empty: dmaengine_prep_slave_sg() forwards an
sg_len of 0 to the driver unmodified, ls1x_dma_prep_slave_sg() does not
reject it, and ls1x_dma_prep_lli() then builds no LLIs (the for_each_sg
loop body never executes) yet still returns success. The resulting
descriptor with an empty lli_list is queued as a valid transfer and the
problem only blows up later in issue_pending. This was found by code
audit; we do not have Loongson1 hardware to reproduce it at runtime.

Fix it in two places, following defense in depth: reject sg_len == 0
requests early in ls1x_dma_prep_slave_sg() (a zero-length transfer is
meaningless anyway), and switch ls1x_dma_issue_pending() to
list_first_entry_or_null() with a NULL check so an empty lli_list can
never reach the hardware programming path. Neither change affects the
normal non-empty path.

One related pre-existing issue is deliberately not addressed here:
ls1x_dma_prep_dma_cyclic() derives sg_len as buf_len / period_len, so a
caller passing buf_len < period_len gets sg_len == 0 and crashes even
earlier (sg_init_table() on a zero-entry table), before issue_pending
is ever reached. That is a separate bug in the cyclic prep path and is
left for a follow-up patch.

Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
---
 drivers/dma/loongson/loongson1-apb-dma.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/loongson/loongson1-apb-dma.c b/drivers/dma/loongson/loongson1-apb-dma.c
index 89786cbd2..e7eb40584 100644
--- a/drivers/dma/loongson/loongson1-apb-dma.c
+++ b/drivers/dma/loongson/loongson1-apb-dma.c
@@ -302,6 +302,9 @@ ls1x_dma_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
 	dev_dbg(chan2dev(dchan), "sg_len=%u flags=0x%lx dir=%s\n",
 		sg_len, flags, dmaengine_get_direction_text(dir));
 
+	if (!sg_len)
+		return NULL;
+
 	desc = ls1x_dma_alloc_desc();
 	if (!desc)
 		return NULL;
@@ -478,8 +481,11 @@ static void ls1x_dma_issue_pending(struct dma_chan *dchan)
 			struct ls1x_dma_desc *desc = to_ls1x_dma_desc(vd);
 			struct ls1x_dma_lli *lli;
 
-			lli = list_first_entry(&desc->lli_list,
-					       struct ls1x_dma_lli, node);
+			lli = list_first_entry_or_null(&desc->lli_list,
+						       struct ls1x_dma_lli, node);
+			if (!lli)
+				return;
+
 			ls1x_dma_start(chan, &lli->phys);
 		}
 	}
-- 
2.30.2

Re: [PATCH] dmaengine: loongson1: fix list_first_entry on possibly empty lli_list

[Frank Li]

On Mon, Oct 26, 2026 at 07:51:13PM +0800, Li Ximo wrote:
> [You don't often get email from lixicaicai@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> From: Wang Haoran <haoranwangsec@gmail.com>
>
> ls1x_dma_issue_pending() calls list_first_entry(&desc->lli_list, ...)
> without checking whether the list is empty. list_first_entry() does not
> return NULL for an empty list; it returns the container_of() of the list
> head pointer, i.e. a wild pointer that points backwards into the
> enclosing struct ls1x_dma_desc/virt_dma_desc area. The bogus &lli->phys
> is then passed to ls1x_dma_start(), which dereferences it (out-of-bounds
> read) and programs the DMA controller with the garbage address.
>
> The list can indeed be empty: dmaengine_prep_slave_sg() forwards an
> sg_len of 0 to the driver unmodified, ls1x_dma_prep_slave_sg() does not
> reject it, and ls1x_dma_prep_lli() then builds no LLIs (the for_each_sg
> loop body never executes) yet still returns success. The resulting
> descriptor with an empty lli_list is queued as a valid transfer and the
> problem only blows up later in issue_pending. This was found by code
> audit; we do not have Loongson1 hardware to reproduce it at runtime.
>
> Fix it in two places, following defense in depth: reject sg_len == 0
> requests early in ls1x_dma_prep_slave_sg() (a zero-length transfer is
> meaningless anyway), and switch ls1x_dma_issue_pending() to
> list_first_entry_or_null() with a NULL check so an empty lli_list can
> never reach the hardware programming path. Neither change affects the
> normal non-empty path.
>
> One related pre-existing issue is deliberately not addressed here:
> ls1x_dma_prep_dma_cyclic() derives sg_len as buf_len / period_len, so a
> caller passing buf_len < period_len gets sg_len == 0 and crashes even
> earlier (sg_init_table() on a zero-entry table), before issue_pending
> is ever reached. That is a separate bug in the cyclic prep path and is
> left for a follow-up patch.
>
> Reported-by: Wang Haoran <haoranwangsec@gmail.com>
> Reported-by: Li Ximo <lixicaicai@gmail.com>
> Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
> ---
>  drivers/dma/loongson/loongson1-apb-dma.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/dma/loongson/loongson1-apb-dma.c b/drivers/dma/loongson/loongson1-apb-dma.c
> index 89786cbd2..e7eb40584 100644
> --- a/drivers/dma/loongson/loongson1-apb-dma.c
> +++ b/drivers/dma/loongson/loongson1-apb-dma.c
> @@ -302,6 +302,9 @@ ls1x_dma_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
>         dev_dbg(chan2dev(dchan), "sg_len=%u flags=0x%lx dir=%s\n",
>                 sg_len, flags, dmaengine_get_direction_text(dir));
>
> +       if (!sg_len)
> +               return NULL;
> +
>         desc = ls1x_dma_alloc_desc();
>         if (!desc)
>                 return NULL;
> @@ -478,8 +481,11 @@ static void ls1x_dma_issue_pending(struct dma_chan *dchan)
>                         struct ls1x_dma_desc *desc = to_ls1x_dma_desc(vd);
>                         struct ls1x_dma_lli *lli;
>
> -                       lli = list_first_entry(&desc->lli_list,
> -                                              struct ls1x_dma_lli, node);
> +                       lli = list_first_entry_or_null(&desc->lli_list,
> +                                                      struct ls1x_dma_lli, node);
> +                       if (!lli)
> +                               return;
> +

This two problem, please use seperate patch to fix it.

Frank

>                         ls1x_dma_start(chan, &lli->phys);
>                 }
>         }
> --
> 2.30.2
>