github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

firewire: core: add test for beyond-boundary case in config ROM generator

Browse Source 
Although unit drivers and userspace applications are allowed to extend
the system configuration ROM, they could provide invalid extension data.

Add a KUnit test to verify that the generator does not write beyond the
boundary of the configuration ROM when handling an extension.

Link: https://lore.kernel.org/r/20260901134534.2386577-14-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
This commit is contained in:
Takashi Sakamoto 2026-09-01 22:45:34 +09:00
parent eb077c3503
commit 6899ac01c6
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/firewire/config-rom-generator-test.c
View File

@ -342,6 +342,26 @@ static void add_descriptor_with_invalid_data(struct kunit *test)
KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&entry_with_invalid_data), -EINVAL);
}
static void add_descriptor_beyond_upper_limit(struct kunit *test)
{
// Use kernel stack since they should be mutable for doubly linked-list.
struct fw_descriptor entry_beyond_upper_limit = {
.length = 255,
.key = (CSR_DIRECTORY | CSR_UNIT) << 24,
.data = NULL,
};
u32 *data;
data = kunit_kzalloc(test, entry_beyond_upper_limit.length, GFP_KERNEL);
KUNIT_ASSERT_NOT_NULL(test, data);
data[0] = (entry_beyond_upper_limit.length - 1) << 16;
entry_beyond_upper_limit.data = data;
KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&entry_beyond_upper_limit), -EBUSY);
kunit_kfree(test, data);
}
static const struct fw_card_driver dummy_card_driver;
static int config_rom_generator_test_init(struct kunit *test)
@ -374,6 +394,7 @@ static struct kunit_case config_rom_generator_test_cases[] = {
KUNIT_CASE_PARAM(test_config_rom_generator, generator_test_gen_params),
KUNIT_CASE(add_descriptor_with_invalid_length),
KUNIT_CASE(add_descriptor_with_invalid_data),
KUNIT_CASE(add_descriptor_beyond_upper_limit),
{}
};