From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A14C13FEE for ; Sat, 6 Jun 2026 01:44:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780710296; cv=none; b=f3azkM9OLBKe2vTr3uGfg6getw7Uz+q4lqgKy7bqdaf9qylCXTeNIQwbEvLsQHt5CwzFhsFqf2C6a6/0t0ElpT0Qlhvw4Dwzp3wvdI4BaquSnd+mViY1NGfHaQ6PlYFzbQIqgmtFbtVakbgJGqArBVFDSmnLc7Wr5zmLK0H9D0M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780710296; c=relaxed/simple; bh=v0MTlstJUnjY5zWFMeeS3Fx4Wwdb3s/r36oAifxU9uw=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=h7gotFOTQWsuG1Xb5iW5huGaG/c2B739uxD5mZBVd4JBmxV0bSxomfnfsDPs3oLYVBt6gZVbd0jCWOodDgERyQknrKUm0S3FXOmfrZcWKvhHMDd3xsLPH156O+CcQXavHFntQrh0AwRSjnWgseAgkdAo0ykzDn+eYpHSnR4/SxI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=G/7YSjkO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="G/7YSjkO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B05FF1F00893; Sat, 6 Jun 2026 01:44:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1780710294; bh=8gsIvPynCD+Vm/swWjt2iFbxwRvZbAwj40DyEDtSIA0=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=G/7YSjkOyYiFCrWRRV8yjUHRzHH6OOvEtOzPm+53vJVSUqnOeTkgyK4AIaYbaThiE 3eZ0TxEIOTFwJt1Nk6LNZd2Cr1DA/Vg3SHfM71hwYLt/Z/g1hNGCQvRuWGSaludyH7 NSo300LBE3dDBpFzGblfOobA01a6vJfmgsnyJe1E= Date: Fri, 5 Jun 2026 18:44:54 -0700 From: Andrew Morton To: Samuel Moelius Cc: linux-kernel@vger.kernel.org (open list:LIBRARY CODE), Kees Cook , Luis R. Rodriguez , Scott Branden Subject: Re: [PATCH] lib/test_firmware: allocate the configured into_buf size Message-Id: <20260605184454.badf4e5002f7bdd54cc8d3fe@linux-foundation.org> In-Reply-To: <20260605003038.2005840-1-sam.moelius@trailofbits.com> References: <20260605003038.2005840-1-sam.moelius@trailofbits.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Fri, 5 Jun 2026 00:30:37 +0000 Samuel Moelius wrote: > The batched into_buf test path allocates TEST_FIRMWARE_BUF_SIZE bytes > unconditionally, but then passes test_fw_config->buf_size to > request_firmware_into_buf() or request_partial_firmware_into_buf(). > > Userspace can set config_buf_size above TEST_FIRMWARE_BUF_SIZE before > triggering a batched request. If the firmware file is large enough, the > firmware loader writes past the end of the 1 KiB test buffer. > > Allocate the buffer with the same size that the test passes to the firmware > API so config_buf_size remains the actual buffer size under test. Cool, thanks. > Assisted-by: Codex:gpt-5.5-cyber-preview Sashiko evidently looked further: https://sashiko.dev/#/patchset/20260605003038.2005840-1-sam.moelius@trailofbits.com And appears to have found other bugs in test_firmware.c. Let me cc a few people who have previously worked on this.