axis_fifo_write() bounds a transmit by checking:

    words_to_write > (fifo->tx_fifo_depth - 4)

fifo->tx_fifo_depth is an unsigned int populated directly from the
devicetree property "xlnx,tx-fifo-depth" in axis_fifo_parse_dt(),
with no lower-bound validation. If a devicetree ever supplies a
tx-fifo-depth smaller than 4 (e.g. a malformed or misconfigured DT),
"tx_fifo_depth - 4" underflows, wrapping to a huge value. The size
check above then never triggers, silently defeating the exact
overrun protection the surrounding comment describes: writes far
larger than the FIFO's real capacity get accepted and passed to the
hardware, driving it into the "Transmit Packet Overrun Error"
condition the check exists to prevent.

Validate tx_fifo_depth against the minimum the driver requires at
devicetree-parse time, matching the existing validation style already
used in axis_fifo_parse_dt() for the other DT properties.

Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com>
---
 drivers/staging/axis-fifo/axis-fifo.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
index 3d358f9193523c..dba76fbf5d685a 100644
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
@@ -412,6 +412,13 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo)
 				   &fifo->tx_fifo_depth);
 	if (ret)
 		return ret;
+	/*
+	 * axis_fifo_write() computes 'tx_fifo_depth - 4' to bound the size of
+	 * a transmit; a depth smaller than that underflows the unsigned
+	 * subtraction and silently disables the overrun check.
+	 */
+	if (fifo->tx_fifo_depth < 4)
+		return -EINVAL;
 
 	ret = of_property_read_u32(node, "xlnx,use-rx-data",
 				   &fifo->has_rx_fifo);
--
2.43.0

On Tue, Sep 01, 2026 at 08:31:41AM +0530, Manush Prajwal wrote:
> axis_fifo_write() bounds a transmit by checking:
> 
>     words_to_write > (fifo->tx_fifo_depth - 4)
> 
> fifo->tx_fifo_depth is an unsigned int populated directly from the
> devicetree property "xlnx,tx-fifo-depth" in axis_fifo_parse_dt(),
> with no lower-bound validation. If a devicetree ever supplies a
> tx-fifo-depth smaller than 4 (e.g. a malformed or misconfigured DT),
> "tx_fifo_depth - 4" underflows, wrapping to a huge value. The size
> check above then never triggers, silently defeating the exact
> overrun protection the surrounding comment describes: writes far
> larger than the FIFO's real capacity get accepted and passed to the
> hardware, driving it into the "Transmit Packet Overrun Error"
> condition the check exists to prevent.

So this is just a bug in the device tree?

How was this found and tested?

> Validate tx_fifo_depth against the minimum the driver requires at
> devicetree-parse time, matching the existing validation style already
> used in axis_fifo_parse_dt() for the other DT properties.
> 
> Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com>
> ---
>  drivers/staging/axis-fifo/axis-fifo.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
> index 3d358f9193523c..dba76fbf5d685a 100644
> --- a/drivers/staging/axis-fifo/axis-fifo.c
> +++ b/drivers/staging/axis-fifo/axis-fifo.c
> @@ -412,6 +412,13 @@ static int axis_fifo_parse_dt(struct axis_fifo *fifo)
>  				   &fifo->tx_fifo_depth);
>  	if (ret)
>  		return ret;
> +	/*
> +	 * axis_fifo_write() computes 'tx_fifo_depth - 4' to bound the size of
> +	 * a transmit; a depth smaller than that underflows the unsigned
> +	 * subtraction and silently disables the overrun check.
> +	 */

Did you forget to add an Assisted-by: tag for this patch?

thanks,

greg k-h