Re: [PATCH] staging: axis-fifo: fix integer underflow in TX size check

[Dan Carpenter <error27@gmail.com>]

On Mon, Nov 02, 2026 at 02:44:51PM +0300, Maritu Hone wrote:
> fifo->tx_fifo_depth is an unsigned int parsed from the devicetree
> property "xlnx,tx-fifo-depth" with no lower-bound validation.
> The
> write() packet-size check subtracts 4 from it:
> 
> 	words_to_write > (fifo->tx_fifo_depth - 4)
> 
> If tx_fifo_depth is less than 4, this subtraction underflows and
> wraps around to a value near UINT_MAX, so the check that is supposed
> to reject oversized writes never triggers, regardless of how large
> words_to_write actually is.
> 
> Reject the write up front when tx_fifo_depth is below the minimum
> required by the hardware, before the subtraction can underflow.
> 
> Fixes: 52ff2b840bc7 ("staging: axis-fifo: fix maximum TX packet length check")
> Signed-off-by: Maritu Hone <marehone12@gmail.com>
> ---

This patch has been rejected many times before.  Best to do a search on
lore.kernel.org before sending patches.

Device trees are trusted.  I wonder if the AI is actually searching the
device trees and not finding anything, so it thinks maybe the device
tree is wrong?

$ git grep xlnx,tx-fifo-depth | cat
drivers/staging/axis-fifo/axis-fifo.c:	ret = of_property_read_u32(node, "xlnx,tx-fifo-depth",
drivers/staging/axis-fifo/axis-fifo.txt:- xlnx,tx-fifo-depth: Depth of TX FIFO in words
drivers/staging/axis-fifo/axis-fifo.txt:	xlnx,tx-fifo-depth = <0x8000>;

regards,
dan carpenter