github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

lib/test_firmware: allocate the configured into_buf size

Browse Source 
The batched into_buf test path allocates TEST_FIRMWARE_BUF_SIZE bytes
unconditionally, but then passes test_fw_config->buf_size to
request_firmware_into_buf() or request_partial_firmware_into_buf().

Userspace can set config_buf_size above TEST_FIRMWARE_BUF_SIZE before
triggering a batched request. If the firmware file is large enough, the
firmware loader writes past the end of the 1 KiB test buffer.

Allocate the buffer with the same size that the test passes to the firmware
API so config_buf_size remains the actual buffer size under test.

Assisted-by: Codex:gpt-5.5-cyber-preview
Link: https://lore.kernel.org/20260605003038.2005840-1-sam.moelius@trailofbits.com
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Luis R. Rodriguez <mcgrof@kernel.org>
Cc: Scott Branden <scott.branden@broadcom.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Samuel Moelius 2026-06-05 00:30:37 +00:00 committed by Andrew Morton
parent 89009392c8
commit f2737dc40d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/test_firmware.c
View File

@ -867,7 +867,7 @@ static int test_fw_run_batch_request(void *data)
if (test_fw_config->into_buf) {
void *test_buf;
test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
test_buf = kzalloc(test_fw_config->buf_size, GFP_KERNEL);
if (!test_buf)
return -ENOMEM;