Merge patch series "virtio: rng: Handle oversized return buffers"

Meet Patel <[email protected]> says:

The virtio-rng test to verify effective handling of oversized return
buffers checks that an (undocumented) error is raised, instead of the
real concern, which is the surrounding buffer integrity following a rng
function call.
Update the test to check that the other contents of a buffer remain
unchanged instead of looking for an error code.

Link: https://lore.kernel.org/r/[email protected]

2 files changed, 13 insertions, 3 deletions

diff --git a/drivers/virtio/virtio_rng.c b/drivers/virtio/virtio_rng.c
index 90a371a59cc..c6de62142bb 100644
--- a/drivers/virtio/virtio_rng.c
+++ b/drivers/virtio/virtio_rng.c
@@ -46,7 +46,7 @@ static int virtio_rng_read(struct udevice *dev, void *data, size_t len)
 			;
 
 		if (rsize > sg.length)
-			return -EIO;
+			rsize = sg.length;
 
 		memcpy(ptr, buf, rsize);
 		len -= rsize;
diff --git a/test/dm/virtio_rng.c b/test/dm/virtio_rng.c
index e404b08484e..5fd56ade586 100644
--- a/test/dm/virtio_rng.c
+++ b/test/dm/virtio_rng.c
@@ -19,12 +19,19 @@ struct virtio_rng_priv {
 	struct virtqueue *rng_vq;
 };
 
+#define BUFFER_SIZE 16
+#define CANARY "CANARYCANARYCANARYCANARY"
+
 /* Test the virtio-rng driver validates the used size */
 static int dm_test_virtio_rng_check_len(struct unit_test_state *uts)
 {
 	struct udevice *bus, *dev;
 	struct virtio_rng_priv *priv;
-	u8 buffer[16];
+	u8 buffer[BUFFER_SIZE + sizeof(CANARY)];
+
+	/* write known data to buffer */
+	memset(buffer, 0xaa, BUFFER_SIZE);
+	memcpy(buffer + BUFFER_SIZE, CANARY, sizeof(CANARY));
 
 	/* check probe success */
 	ut_assertok(uclass_first_device_err(UCLASS_VIRTIO, &bus));
@@ -44,7 +51,10 @@ static int dm_test_virtio_rng_check_len(struct unit_test_state *uts)
 	priv->rng_vq->vring.used->ring[0].len = U32_MAX;
 
 	/* check the driver gracefully handles the error */
-	ut_asserteq(-EIO, dm_rng_read(dev, buffer, sizeof(buffer)));
+	dm_rng_read(dev, buffer, BUFFER_SIZE);
+
+	/* check for the canary bytes behind the real buffer */
+	ut_asserteq_mem(buffer + BUFFER_SIZE, CANARY, sizeof(CANARY));
 
 	return 0;
 }