u-boot.git/test, branch main

test: boot: measurement: Fix compilation for non-sandbox builds

2026-08-28T18:24:05Z

asm/io.h provides map_to_sysmem() only for the sandbox. Other targets fail the build with ../test/boot/measurement.c: In function ‘measure’: ../test/boot/measurement.c:30:33: error: implicit declaration of function ‘map_to_sysmem’; did you mean ‘map_physmem’? [-Wimplicit-function-declaration] 30 | images.os.image_start = map_to_sysmem(kernel); | ^~~~~~~~~~~~~ | map_physmem Use the proper header that will pull asm/io.h only where needed. Signed-off-by: Jan Kiszka

Merge patch series "fs/squashfs: fix directory table integer overflow"

2026-08-27T21:05:06Z

Shahriyar Jalayeri says: This fixes an integer overflow in the SquashFS directory-table reader that leads to a heap out-of-bounds write, and adds a regression test. sqfs_read_directory_table() sizes the directory table with an int multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a crafted image, under-allocating the buffer that the fill loop then overruns. It is reached by listing or reading the image (sqfsls / sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow(); patch 2 adds a test that a crafted image is rejected. Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request. [trini: As part of the merge, this touches on what commit 9a9d46cb5e1a ("fs/squashfs: fix heap exhaustion during symlink resolution") also handles, but they appear to be separate issues] Link: https://lore.kernel.org/r/20260728-sqfs-oob-fix-v2-0-077d9f0e01c4@byteray.co.uk

test: squashfs: add directory table overflow regression test

2026-08-27T21:01:02Z

Add a Python test that lists a crafted SquashFS image whose directory table declares an oversized metadata-block count. Such an image must be rejected without corrupting the heap, which the test checks by confirming U-Boot is still responsive afterwards. Signed-off-by: Shahriyar Jalayeri Reviewed-by: Richard Genoud

lmb: Return -EFAULT when freeing unallocated memory regions

2026-08-24T19:58:00Z

Make lmb_free() return -EFAULT when the requested memory region is not allocated, instead of the generic -1 error value. Document the updated error code in the public API comment and change the LMB unit test to check for the new -EFAULT errno value. Signed-off-by: Jonas Karlman Reviewed-by: Randolph Sapp

lmb: Return -EFAULT when requested region is not part of memory map

2026-08-24T19:58:00Z

lmb_alloc_addr() is documented to return -EINVAL when the requested memory region is not part of the LMB memory map. However, -EINVAL is also used to e.g. indicate that a NULL pointer is passed as the addr parameter or when the requested memory region partially overlaps an existing region. Change lmb_alloc_addr() to return -EFAULT when the requested memory region is not part of the LMB memory map to make the type of error known to callers. Also extend unit tests to validate that the return code has stay the same when the requested memory region partially overlaps. No caller of lmb_alloc_addr() is checking what type of error code is returned, so this change has no intended behavior change. Signed-off-by: Jonas Karlman Reviewed-by: Randolph Sapp

test: dm: hash: check digest size before memset

2026-08-20T18:15:24Z

hash_algo_digest_size() returns -EINVAL for an invalid algorithm. The test success provider passes that result directly to memset(), where it is converted to a large size_t. Return the error before touching the output buffer, and exercise the invalid-algorithm path in the provider-selection test. This addresses Coverity CIDs 652907 and 652908. Fixes: 94b349bd902d ("crypto: hash: use DM providers from hash command") Signed-off-by: James Hilliard

Merge patch series "gunzip: Fix spurious Z_BUF_ERROR in chunked gzwrite decompression"

2026-08-20T18:15:24Z

Aristo Chen says: The dm_test_cmd_zip_gzwrite sandbox test occasionally fails in CI with: 12582912/16777216 Error: inflate() returned -5 The chunked decompression loop added in commit 58e523fedf48 ("gunzip: Implement chunked decompression") treats Z_BUF_ERROR from inflate() as fatal. When an input chunk is exhausted at exactly the same time as the write buffer fills up, the next inflate() call is made with avail_in == 0, cannot make progress, and returns Z_BUF_ERROR. Per the zlib documentation this only means "no progress was possible" and the call should be repeated with more input, which is what the reference implementation in zlib examples/zpipe.c does. The failure needs the consumed/produced byte counts to line up with both the chunk size and the write buffer size at once, with no buffered output on the inflate side, which is why only certain random payloads trigger it. Note that the failure offset above is a multiple of the 1 MiB write buffer while gzwrite_chunk was SZ_1M + 1. Patch 1 makes gzwrite() refill the input chunk in this situation. Patch 2 adds a deterministic regression test which builds a gzip file from two stored deflate blocks by hand and aligns the chunk boundary with the write buffer boundary exactly, failing reliably without patch 1. Verified on sandbox and sandbox64: - dm_test_cmd_gzwrite_chunk_boundary fails with -5 in 20 out of 20 runs before the fix, passes 100 out of 100 runs after - dm_test_cmd_zip_gzwrite fails 17 out of 2000 runs (about 1%) before the fix, every time with the same signature as the CI flake, and passes 2000 out of 2000 runs after - dm_test_cmd_zip_unzip keeps passing Link: https://lore.kernel.org/r/20260808004437.4367-1-aristo.chen@canonical.com

test: cmd: Add gzwrite chunk boundary regression test

2026-08-20T15:59:25Z

Add a deterministic regression test for the gzwrite() case where a decompression input chunk is exhausted at exactly the same time as the write buffer fills up. Build a gzip file by hand from two 1 KiB stored deflate blocks and pick a chunk size that covers exactly the first block header plus its payload, so that with a 1 KiB write buffer the first input chunk runs out precisely when the write buffer is full. Unlike the existing random data test, which only hits this corner case for rare byte patterns (about 1 percent of runs on sandbox64), this test fails 20 out of 20 runs without the preceding gunzip fix: Error: inflate() returned -5 and passed 100 out of 100 runs with it. Signed-off-by: Aristo Chen Reviewed-by: Simon Glass

Merge tag 'net-20260813' of https://git.u-boot-project.org/u-boot/custodians/u-boot-net

2026-08-13T14:58:29Z

Pull request net-20260813. net: - phy: dp83867: enable extended read / write for driver - phy: fix duplicate eth_phy binding - Drop unnecessary device_set_name - dwc_eth_xgmac: Return -ENODEV when phy_connect() fails - nfs: clean up bounds checks in nfs_readlink_reply() - rtl8169: add support for RTL8126A and RTL8127A - srand_mac(): fix -ENODEV crash with CONFIG_DM_RNG net-legacy: - Fix out-of-bounds write in IP fragment reassembly - test: net: add regression test for IP reassembly overflow net-lwip: - Add tftpsrv command - Handle chained pbufs in transmit path - sntp: fix netif leak when ntpserverip is unset - wget: free mbedtls x509 cert context to avoid memory leak - Fix DHCP fine timer interval

board_f: Call initf_malloc() before fdtdec_setup()

2026-08-10T20:48:11Z

In case MULTI_DTB_FIT_GZIP is enabled, fdtdec_setup() does uncompress the compressed DTs in uncompress_blob() using gunzip(), which invokes malloc() internally. The early simple malloc is initialized in board_f initf_malloc() call, which sets up the early simple malloc limit and offset pointer in global data. Currently, the initf_malloc() is called after fdtdec_setup(), which leads to malloc failure in fdtdec_setup() during the gzip decompression, because the early simple malloc is not initialized yet. Call initf_malloc() before fdtdec_setup() to assure fdtdec_setup() can use malloc() during gzip decompression of the DTs. The impact of this change on boot time is negligible, because the initf_malloc() only assigns two fields in global data. Signed-off-by: Marek Vasut Fixes: 95f4bbd581cf ("lib: fdt: Allow LZO and GZIP DT compression in U-Boot") Reviewed-by: Simon Glass [trini: Update test/py/tests/test_trace.py] Signed-off-by: Tom Rini