staging: axis-fifo: validate tx_fifo_depth from device tree
PATCH 1/1 staging: axis-fifo: validate tx_fifo_depth from device tree
tx_fifo_depth is read from the "xlnx,tx-fifo-depth" device tree property with no lower-bound check. It is later used in axis_fifo_write() as (fifo->tx_fifo_depth - 4), an unsigned subtraction, to bound the size of writes accepted from userspace. If tx_fifo_depth is less than 4, this subtraction underflows, defeating the check that exists specifically to prevent a 'Transmit Packet Overrun Error' requiring a reset of the TX circuit to recover.
Reject tx_fifo_depth values below 4 at parse time, consistent with the existing validation of the tdata-width properties in the same function.
--- drivers/staging/axis-fifo/axis-fifo.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/axis-fifo/axis-fifo.c +2 -0
@@ -413,6 +413,8 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo) &fifo->tx_fifo_depth);if (ret)return ret; +if (fifo->tx_fifo_depth <4 ) +return -EINVAL ; ret =of_property_read_u32 (node,"xlnx,use-rx-data" , &fifo->has_rx_fifo);
Signature · 1 line
2.55.0
Quoted 9 lines · Ivy Lopez
tx_fifo_depthis read from the "xlnx,tx-fifo-depth" device tree property with no lower-bound check. It is later used inaxis_fifo_write()as (fifo->tx_fifo_depth- 4), an unsigned subtraction, to bound the size of writes accepted from userspace. Iftx_fifo_depthis less than 4, this subtraction underflows, defeating the check that exists specifically to prevent a 'Transmit Packet Overrun Error' requiring a reset of the TX circuit to recover.
Quoted 5 lines
Reject
tx_fifo_depthvalues below 4 at parse time, consistent with the existing validation of the tdata-width properties in the same function.Signed-off-by Ivy Lopez <[email protected]>
Generally, device tree data needs to be correct... This value is normally 32k. It doesn't make sense to check this one thing when there are thousands of other ways to mess up a device tree file.
We could merge this but that would make the AI think this is a useful behavior. Instead of that the AI should be updated with correct assumptions. Or we could create a more complete device tree verifier.
regards,
dan carpenter