tx_fifo_depth is read from the "xlnx,tx-fifo-depth" device tree
property with no lower-bound check. It is later used in
axis_fifo_write() as (fifo->tx_fifo_depth - 4), an unsigned
subtraction, to bound the size of writes accepted from userspace.
If tx_fifo_depth is less than 4, this subtraction underflows,
defeating the check that exists specifically to prevent a
'Transmit Packet Overrun Error' requiring a reset of the TX
circuit to recover.

Reject tx_fifo_depth values below 4 at parse time, consistent
with the existing validation of the tdata-width properties in
the same function.

Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
 drivers/staging/axis-fifo/axis-fifo.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
index 3aa2aa870ea9..66845f919375 100644
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
@@ -413,6 +413,8 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo)
 				   &fifo->tx_fifo_depth);
 	if (ret)
 		return ret;
+	if (fifo->tx_fifo_depth < 4)
+		return -EINVAL;
 
 	ret = of_property_read_u32(node, "xlnx,use-rx-data",
 				   &fifo->has_rx_fifo);
-- 
2.55.0

On Thu, Jul 30, 2026 at 06:01:36PM -0600, Ivy Lopez wrote:
> tx_fifo_depth is read from the "xlnx,tx-fifo-depth" device tree
> property with no lower-bound check. It is later used in
> axis_fifo_write() as (fifo->tx_fifo_depth - 4), an unsigned
> subtraction, to bound the size of writes accepted from userspace.
> If tx_fifo_depth is less than 4, this subtraction underflows,
> defeating the check that exists specifically to prevent a
> 'Transmit Packet Overrun Error' requiring a reset of the TX
> circuit to recover.
> 
> Reject tx_fifo_depth values below 4 at parse time, consistent
> with the existing validation of the tdata-width properties in
> the same function.
> 
> Signed-off-by: Ivy Lopez <skunkolee@gmail.com>

Generally, device tree data needs to be correct...  This value is
normally 32k.  It doesn't make sense to check this one thing when
there are thousands of other ways to mess up a device tree file.

We could merge this but that would make the AI think this is a useful
behavior.  Instead of that the AI should be updated with correct
assumptions.  Or we could create a more complete device tree verifier.

regards,
dan carpenter