From 6899ac01c6ae398daf2acbf78f7a2dd86e3c0af5 Mon Sep 17 00:00:00 2001 From: Takashi Sakamoto Date: Tue, 1 Sep 2026 22:45:34 +0900 Subject: [PATCH] firewire: core: add test for beyond-boundary case in config ROM generator Although unit drivers and userspace applications are allowed to extend the system configuration ROM, they could provide invalid extension data. Add a KUnit test to verify that the generator does not write beyond the boundary of the configuration ROM when handling an extension. Link: https://lore.kernel.org/r/20260901134534.2386577-14-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto --- drivers/firewire/config-rom-generator-test.c | 21 ++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/drivers/firewire/config-rom-generator-test.c b/drivers/firewire/config-rom-generator-test.c index 3114110307b5..212dbdcd43ba 100644 --- a/drivers/firewire/config-rom-generator-test.c +++ b/drivers/firewire/config-rom-generator-test.c @@ -342,6 +342,26 @@ static void add_descriptor_with_invalid_data(struct kunit *test) KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&entry_with_invalid_data), -EINVAL); } +static void add_descriptor_beyond_upper_limit(struct kunit *test) +{ + // Use kernel stack since they should be mutable for doubly linked-list. + struct fw_descriptor entry_beyond_upper_limit = { + .length = 255, + .key = (CSR_DIRECTORY | CSR_UNIT) << 24, + .data = NULL, + }; + u32 *data; + + data = kunit_kzalloc(test, entry_beyond_upper_limit.length, GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, data); + + data[0] = (entry_beyond_upper_limit.length - 1) << 16; + entry_beyond_upper_limit.data = data; + KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&entry_beyond_upper_limit), -EBUSY); + + kunit_kfree(test, data); +} + static const struct fw_card_driver dummy_card_driver; static int config_rom_generator_test_init(struct kunit *test) @@ -374,6 +394,7 @@ static struct kunit_case config_rom_generator_test_cases[] = { KUNIT_CASE_PARAM(test_config_rom_generator, generator_test_gen_params), KUNIT_CASE(add_descriptor_with_invalid_length), KUNIT_CASE(add_descriptor_with_invalid_data), + KUNIT_CASE(add_descriptor_beyond_upper_limit), {} };