Add tests where the length field of the USB transport header is below the minimum value, and where the DMTF ID is invalid.
Signed-off-by: James Lee <[email protected]> --- drivers/net/mctp/mctp-usblib-test.c | 69 ++++++++++++++++++++++++++++++++++++- 1 file changed, 68 insertions(+), 1 deletion(-) diff --git a/drivers/net/mctp/mctp-usblib-test.c b/drivers/net/mctp/mctp-usblib-test.c index 1a6dd6d10daab314f5e082477ecd3b9518f6b50e..4f499de9a6ce4452dcc71ac38fa26b6595977f77 100644 --- a/drivers/net/mctp/mctp-usblib-test.c +++ b/drivers/net/mctp/mctp-usblib-test.c @@ -440,7 +440,6 @@ static void mctp_usblib_test_rx_header_splits(struct kunit *test) struct mctp_usblib_test_dev *dev; struct mctp_usblib_test_ctx *ctx; struct mctp_usblib_rx *rx; - size_t i; ctx = mctp_usblib_test_init(test); rx = mctp_usblib_test_rx_init(test, true); @@ -459,11 +458,79 @@ static void mctp_usblib_test_rx_header_splits(struct kunit *test) mctp_usblib_test_rx_split_header(test, 8, dev, rx); } +/* Test the submission of a packet with an impossibly small value in the + * header's length field. Values less than HDR_LEN are invalid. + */ +static void mctp_usblib_test_rx_short_packet(struct kunit *test) +{ + struct mctp_usblib_test_dev *dev; + struct mctp_usblib_test_ctx *ctx; + struct mctp_usblib_rx *rx; + size_t len, buflen; + u8 pktbuf[12]; + void *buf; + int rc; + + ctx = mctp_usblib_test_init(test); + rx = mctp_usblib_test_rx_init(test, true); + dev = ctx->dev; + + len = sizeof(pktbuf); + mctp_usblib_test_init_pkt(pktbuf, len, HDR_LEN - 1); + + buflen = 0; + rc = mctp_usblib_rx_prepare(dev->ndev, rx, &buf, &buflen, GFP_KERNEL); + KUNIT_ASSERT_EQ(test, rc, 0); + KUNIT_ASSERT_GE(test, buflen, len); + + memcpy(buf, pktbuf, len); + + rc = mctp_usblib_rx_complete(dev->ndev, rx, len); + KUNIT_EXPECT_EQ(test, rc, -EPROTO); + KUNIT_EXPECT_NULL(test, rx->skb); + KUNIT_EXPECT_EQ(test, dev->rx_pkts.qlen, 0); +} + +static void mctp_usblib_test_rx_invalid_dmtf_id(struct kunit *test) +{ + struct mctp_usblib_test_dev *dev; + struct mctp_usblib_test_ctx *ctx; + struct mctp_usblib_rx *rx; + size_t len, buflen; + u8 pktbuf[12]; + void *buf; + int rc; + + ctx = mctp_usblib_test_init(test); + rx = mctp_usblib_test_rx_init(test, true); + dev = ctx->dev; + + len = sizeof(pktbuf); + mctp_usblib_test_init_pkt(pktbuf, len, len); + + // Make packet DMTF ID invalid + pktbuf[1] = ~pktbuf[1]; + + buflen = 0; + rc = mctp_usblib_rx_prepare(dev->ndev, rx, &buf, &buflen, GFP_KERNEL); + KUNIT_ASSERT_EQ(test, rc, 0); + KUNIT_ASSERT_GE(test, buflen, len); + + memcpy(buf, pktbuf, len); + + rc = mctp_usblib_rx_complete(dev->ndev, rx, len); + KUNIT_EXPECT_EQ(test, rc, -EPROTO); + KUNIT_EXPECT_NULL(test, rx->skb); + KUNIT_EXPECT_EQ(test, dev->rx_pkts.qlen, 0); +} + static struct kunit_case mctp_usblib_test_cases[] = { KUNIT_CASE(mctp_usblib_test_rx_single), KUNIT_CASE_PARAM(mctp_usblib_test_rx_pkt_span, mctp_usblib_test_rx_pkt_span_gen_params), KUNIT_CASE(mctp_usblib_test_rx_header_splits), + KUNIT_CASE(mctp_usblib_test_rx_short_packet), + KUNIT_CASE(mctp_usblib_test_rx_invalid_dmtf_id), {} }; -- 2.47.3
