u-boot.git/test/py, branch main

Merge patch series "fs/squashfs: fix directory table integer overflow"

2026-08-27T21:05:06Z

Shahriyar Jalayeri says: This fixes an integer overflow in the SquashFS directory-table reader that leads to a heap out-of-bounds write, and adds a regression test. sqfs_read_directory_table() sizes the directory table with an int multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a crafted image, under-allocating the buffer that the fill loop then overruns. It is reached by listing or reading the image (sqfsls / sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow(); patch 2 adds a test that a crafted image is rejected. Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request. [trini: As part of the merge, this touches on what commit 9a9d46cb5e1a ("fs/squashfs: fix heap exhaustion during symlink resolution") also handles, but they appear to be separate issues] Link: https://lore.kernel.org/r/20260728-sqfs-oob-fix-v2-0-077d9f0e01c4@byteray.co.uk

test: squashfs: add directory table overflow regression test

2026-08-27T21:01:02Z

Add a Python test that lists a crafted SquashFS image whose directory table declares an oversized metadata-block count. Such an image must be rejected without corrupting the heap, which the test checks by confirming U-Boot is still responsive afterwards. Signed-off-by: Shahriyar Jalayeri Reviewed-by: Richard Genoud

Merge tag 'net-20260813' of https://git.u-boot-project.org/u-boot/custodians/u-boot-net

2026-08-13T14:58:29Z

Pull request net-20260813. net: - phy: dp83867: enable extended read / write for driver - phy: fix duplicate eth_phy binding - Drop unnecessary device_set_name - dwc_eth_xgmac: Return -ENODEV when phy_connect() fails - nfs: clean up bounds checks in nfs_readlink_reply() - rtl8169: add support for RTL8126A and RTL8127A - srand_mac(): fix -ENODEV crash with CONFIG_DM_RNG net-legacy: - Fix out-of-bounds write in IP fragment reassembly - test: net: add regression test for IP reassembly overflow net-lwip: - Add tftpsrv command - Handle chained pbufs in transmit path - sntp: fix netif leak when ntpserverip is unset - wget: free mbedtls x509 cert context to avoid memory leak - Fix DHCP fine timer interval

board_f: Call initf_malloc() before fdtdec_setup()

2026-08-10T20:48:11Z

In case MULTI_DTB_FIT_GZIP is enabled, fdtdec_setup() does uncompress the compressed DTs in uncompress_blob() using gunzip(), which invokes malloc() internally. The early simple malloc is initialized in board_f initf_malloc() call, which sets up the early simple malloc limit and offset pointer in global data. Currently, the initf_malloc() is called after fdtdec_setup(), which leads to malloc failure in fdtdec_setup() during the gzip decompression, because the early simple malloc is not initialized yet. Call initf_malloc() before fdtdec_setup() to assure fdtdec_setup() can use malloc() during gzip decompression of the DTs. The impact of this change on boot time is negligible, because the initf_malloc() only assigns two fields in global data. Signed-off-by: Marek Vasut Fixes: 95f4bbd581cf ("lib: fdt: Allow LZO and GZIP DT compression in U-Boot") Reviewed-by: Simon Glass [trini: Update test/py/tests/test_trace.py] Signed-off-by: Tom Rini

Merge patch series "boot: fit: authenticate the dm-verity roothash"

2026-08-10T18:37:16Z

Daniel Golle says: A signed FIT configuration can delegate the integrity of a (potentially large) root filesystem image to the kernel's dm-verity instead of having U-Boot hash the whole payload at boot: the FIT carries a "dm-verity" subnode with the roothash, salt and block parameters, U-Boot passes the roothash to Linux through the dm-mod.create bootargs, and dm-verity then validates the filesystem block by block against it. For that to be safe the roothash has to be trusted, and in a signed configuration the only thing that establishes trust is the configuration signature. The roothash was not covered by it. fit_config_add_hash() collected the image node, its hash subnodes and its cipher subnode into the signed region, but not the dm-verity subnode, so the roothash, the sole integrity anchor for the filesystem, was left unsigned. The result is a verified-boot bypass for the root filesystem: an attacker who can rewrite the boot medium can replace the filesystem, recompute a matching dm-verity tree, write the new roothash into the unsigned dm-verity subnode, and the configuration signature still verifies. dm-verity then faithfully validates the malicious filesystem against the attacker's roothash. This series closes the gap. Link: https://lore.kernel.org/r/cover.1785276461.git.daniel@makrotopia.org

test: fit: verify dm-verity roothash is covered by the config signature

2026-08-10T18:32:41Z

A dm-verity protected filesystem image is not hashed by U-Boot; its integrity is delegated to the kernel, which trusts the roothash taken from the FIT dm-verity subnode. For that chain of trust to hold, the roothash (and salt) must be part of the region covered by the configuration signature, otherwise an attacker can replace both the filesystem and the roothash while keeping the signature valid. Add two independent checks of this property: - test/py/tests/test_fit_verity_sign.py signs a configuration that references a filesystem image carrying a dm-verity subnode, then confirms that tampering the roothash or the salt is rejected by fit_check_sign. A control that tampers a byte known to be signed proves the check can fail. A matching page is added under doc/develop/pytest/ so the module documentation is rendered with the rest of the generated docs. - test/boot/fit_verity.c gains a runtime unit test that builds the exact node list the configuration signature is computed over, turns it into hashed regions and checks both that the roothash bytes fall inside a signed region and that tampering them changes the hash. It needs no private key, so it also runs on real devices and uses the same hash path a device would. To let the unit test build the signed-region node list, rename the config node-list helper to fit_config_get_signed_nodes(), make it non-static and declare it in image.h. Signed-off-by: Daniel Golle Reviewed-by: Simon Glass

Merge tag 'efi-2026-01-rc2' of https://git.u-boot-project.org/u-boot/custodians/u-boot-efi

2026-07-28T13:52:13Z

Pull request efi-2026-01-rc2 CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-efi/-/pipelines/753 Documentation: * sandbox: fix enum host_platform_flags description * switch from setenv to env set and from printenv to env print * document Renesas R-Car Gen5 RSIP Cortex-R52 start * thead: lpi4a: detail how to enable fastboot UEFI: * unify and correct GUID selection for security database variables * test: check default GUID selection of security database variables * set correct frame buffer address * check efi_deserialize_load_option() in get_dp_device()

Merge patch series "fs: regression-safe load for null_dev_desc_ok fstypes"

2026-07-27T16:52:25Z

Vincent Jardin says: 3 commits providing documentation of impacts and testing the dispatch for null_dev_desc_ok fstypes (semihosting, ubifs, sandbox) in the generic `load ...` command. The test does not cover ubifs, I could not make it work with qemu. Since the code logic is there and testing with semihost is done, it should cover the needed cases. Link: https://lore.kernel.org/r/20260715165735.3207801-1-vjardin@free.fr

test: check default GUID selection of signature database variables

2026-07-27T16:50:28Z

The name to GUID mapping that "env set -e" applies when no -guid option is given was not covered by any test, which is how the wrong default GUID for "dbr" went unnoticed until the previous commit. Add a test case that enrolls each of db, dbx, dbt and dbr in setup mode without an explicit -guid option and checks that every variable is created under the image security database GUID and not under the global variable GUID. Then enroll PK and KEK, also without -guid, and check that both are created under the global variable GUID and not under the image security database GUID. This is also the first coverage of dbt and dbr anywhere under test/. The signature database enrollment happens in setup mode because once secure boot is enabled, efi_variable_authenticate() only accepts writes to PK, KEK, db and dbx; PK and KEK are enrolled last because installing PK leaves setup mode. Signed-off-by: Aristo Chen

test: py: load: check null_dev_desc_ok dispatch

2026-07-27T15:07:39Z

Some pytest modules exercising the dispatch added by fs: dispatch null_dev_desc_ok filesystems before lookup test_load_semihosting.py: "load semihosting - " and the optional [bytes] [pos] variant. Runs on qemu_arm64 with CONFIG_SEMIHOSTING=y; reuses test_hostfs.py's host-staged fixture. test_load_sandbox.py: "load sandbox - " and the optional [bytes] [pos] variant. Runs on sandbox (boardspec('sandbox')); the sandbox fstype is registered with name="sandbox" and null_dev_desc_ok=true, so the same fs_lookup_null_dev_info() helper that routes semihosting also routes the "sandbox". A "load ubifs - " test is intentionally not provided. UBIFS is built on UBI on MTD, which requires some additional works that are not available with qemu/sandbox-ing. Signed-off-by: Vincent Jardin Reviewed-by: Simon Glass