From 8019e3b35df5e780a722fbcb1bf6b2f63eaccc9f Mon Sep 17 00:00:00 2001 From: Kavin Gunasekara Date: Mon, 9 Mar 2026 16:55:04 +0000 Subject: [PATCH 1/2] test: dm: virtio_rng: Update virtio-rng test The virtio-rng test to verify effective handling of oversized return buffers checks that an (undocumented) error is raised, instead of the real concern, which is the surrounding buffer integrity following a rng function call. Update the test to check that the other contents of a buffer remain unchanged instead of looking for an error code. Signed-off-by: Kavin Gunasekara Signed-off-by: Meet Patel Reviewed-by: Andre Przywara --- test/dm/virtio_rng.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/test/dm/virtio_rng.c b/test/dm/virtio_rng.c index e404b08484e..5fd56ade586 100644 --- a/test/dm/virtio_rng.c +++ b/test/dm/virtio_rng.c @@ -19,12 +19,19 @@ struct virtio_rng_priv { struct virtqueue *rng_vq; }; +#define BUFFER_SIZE 16 +#define CANARY "CANARYCANARYCANARYCANARY" + /* Test the virtio-rng driver validates the used size */ static int dm_test_virtio_rng_check_len(struct unit_test_state *uts) { struct udevice *bus, *dev; struct virtio_rng_priv *priv; - u8 buffer[16]; + u8 buffer[BUFFER_SIZE + sizeof(CANARY)]; + + /* write known data to buffer */ + memset(buffer, 0xaa, BUFFER_SIZE); + memcpy(buffer + BUFFER_SIZE, CANARY, sizeof(CANARY)); /* check probe success */ ut_assertok(uclass_first_device_err(UCLASS_VIRTIO, &bus)); @@ -44,7 +51,10 @@ static int dm_test_virtio_rng_check_len(struct unit_test_state *uts) priv->rng_vq->vring.used->ring[0].len = U32_MAX; /* check the driver gracefully handles the error */ - ut_asserteq(-EIO, dm_rng_read(dev, buffer, sizeof(buffer))); + dm_rng_read(dev, buffer, BUFFER_SIZE); + + /* check for the canary bytes behind the real buffer */ + ut_asserteq_mem(buffer + BUFFER_SIZE, CANARY, sizeof(CANARY)); return 0; } From e0eef12a1f46bf946e24050a1da0f067c3952b89 Mon Sep 17 00:00:00 2001 From: Kavin Gunasekara Date: Mon, 9 Mar 2026 16:55:05 +0000 Subject: [PATCH 2/2] virtio: rng: Handle oversized return buffers If extra random bytes are returned, truncate and use the requested number instead of returning an error. Signed-off-by: Kavin Gunasekara Signed-off-by: Meet Patel Reviewed-by: Andre Przywara --- drivers/virtio/virtio_rng.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/virtio/virtio_rng.c b/drivers/virtio/virtio_rng.c index 90a371a59cc..c6de62142bb 100644 --- a/drivers/virtio/virtio_rng.c +++ b/drivers/virtio/virtio_rng.c @@ -46,7 +46,7 @@ static int virtio_rng_read(struct udevice *dev, void *data, size_t len) ; if (rsize > sg.length) - return -EIO; + rsize = sg.length; memcpy(ptr, buf, rsize); len -= rsize;