github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

thunderbolt: test: Add KUnit tests for property parser bounds checks

Browse Source 
Add regression tests for the zero-length entry and root directory
bounds fixes:

- tb_test_property_parse_zero_length: TEXT entry with length 0
  must be rejected by the validator.

- tb_test_property_parse_rootdir_overflow: root directory whose
  content_offset + content_len exceeds block_len must be rejected.

Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
This commit is contained in:
Michael Bommarito 2026-05-25 05:28:30 -04:00 committed by Mika Westerberg
parent 15bcac35ba
commit d73a08958e
1 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
drivers/thunderbolt/test.c
View File

@ -2975,6 +2975,44 @@ static void tb_test_property_parse_dir_len_underflow(struct kunit *test)
tb_property_free_dir(dir);
}
static void tb_test_property_parse_zero_length(struct kunit *test)
{
u32 *block = kunit_kzalloc(test, 6 * sizeof(u32), GFP_KERNEL);
struct tb_property_dir *dir;
KUNIT_ASSERT_NOT_NULL(test, block);
block[0] = 0x55584401; /* rootdir magic */
block[1] = 0x00000004; /* root length: one entry */
block[2] = 0x61616161; /* key_hi */
block[3] = 0x61616161; /* key_lo */
block[4] = 0x74000000; /* type=TEXT, reserved=0, length=0 */
block[5] = 0x00000000; /* value */
dir = tb_property_parse_dir(block, 6);
KUNIT_EXPECT_NULL(test, dir);
tb_property_free_dir(dir);
}
static void tb_test_property_parse_rootdir_overflow(struct kunit *test)
{
u32 *block = kunit_kzalloc(test, 4 * sizeof(u32), GFP_KERNEL);
struct tb_property_dir *dir;
KUNIT_ASSERT_NOT_NULL(test, block);
block[0] = 0x55584401; /* rootdir magic */
block[1] = 0x00000004; /* root length claims 4 dwords of content */
block[2] = 0x61616161;
block[3] = 0x61616161;
/* content_offset(2) + content_len(4) = 6 > block_len(4) */
dir = tb_property_parse_dir(block, 4);
KUNIT_EXPECT_NULL(test, dir);
tb_property_free_dir(dir);
}
static void tb_test_property_merge(struct kunit *test)
{
struct tb_property_dir *dir1, *dir2, *dir3;
@ -3099,6 +3137,8 @@ static struct kunit_case tb_test_cases[] = {
KUNIT_CASE(tb_test_property_parse),
KUNIT_CASE(tb_test_property_format),
KUNIT_CASE(tb_test_property_copy),
KUNIT_CASE(tb_test_property_parse_zero_length),
KUNIT_CASE(tb_test_property_parse_rootdir_overflow),
KUNIT_CASE(tb_test_property_merge),
{ }
};