[PATCH] staging: axis-fifo: fix integer underflow in TX size check

[PATCH] staging: axis-fifo: fix integer underflow in TX size check

[Maritu Hone]

fifo->tx_fifo_depth is an unsigned int parsed from the devicetree
property "xlnx,tx-fifo-depth" with no lower-bound validation. The
write() packet-size check subtracts 4 from it:

	words_to_write > (fifo->tx_fifo_depth - 4)

If tx_fifo_depth is less than 4, this subtraction underflows and
wraps around to a value near UINT_MAX, so the check that is supposed
to reject oversized writes never triggers, regardless of how large
words_to_write actually is.

Reject the write up front when tx_fifo_depth is below the minimum
required by the hardware, before the subtraction can underflow.

Fixes: 52ff2b840bc7 ("staging: axis-fifo: fix maximum TX packet length check")
Signed-off-by: Maritu Hone <marehone12@gmail.com>
---
 drivers/staging/axis-fifo/axis-fifo.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
index 7bb35e11d1dd..aa76be5d78e4 100644
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
@@ -228,6 +228,7 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf,
 	 * raised, which requires a reset of the TX circuit to recover.
 	 */
 	if (!words_to_write || (len % sizeof(u32)) ||
+	    fifo->tx_fifo_depth < 4 ||
 	    (words_to_write > (fifo->tx_fifo_depth - 4)))
 		return -EINVAL;
 
-- 
2.43.0

Re: [PATCH] staging: axis-fifo: fix integer underflow in TX size check

[Dan Carpenter]

On Mon, Nov 02, 2026 at 02:44:51PM +0300, Maritu Hone wrote:
> fifo->tx_fifo_depth is an unsigned int parsed from the devicetree
> property "xlnx,tx-fifo-depth" with no lower-bound validation.
> The
> write() packet-size check subtracts 4 from it:
> 
> 	words_to_write > (fifo->tx_fifo_depth - 4)
> 
> If tx_fifo_depth is less than 4, this subtraction underflows and
> wraps around to a value near UINT_MAX, so the check that is supposed
> to reject oversized writes never triggers, regardless of how large
> words_to_write actually is.
> 
> Reject the write up front when tx_fifo_depth is below the minimum
> required by the hardware, before the subtraction can underflow.
> 
> Fixes: 52ff2b840bc7 ("staging: axis-fifo: fix maximum TX packet length check")
> Signed-off-by: Maritu Hone <marehone12@gmail.com>
> ---

This patch has been rejected many times before.  Best to do a search on
lore.kernel.org before sending patches.

Device trees are trusted.  I wonder if the AI is actually searching the
device trees and not finding anything, so it thinks maybe the device
tree is wrong?

$ git grep xlnx,tx-fifo-depth | cat
drivers/staging/axis-fifo/axis-fifo.c:	ret = of_property_read_u32(node, "xlnx,tx-fifo-depth",
drivers/staging/axis-fifo/axis-fifo.txt:- xlnx,tx-fifo-depth: Depth of TX FIFO in words
drivers/staging/axis-fifo/axis-fifo.txt:	xlnx,tx-fifo-depth = <0x8000>;

regards,
dan carpenter