Re: [PATCH v1 7/7] selftests: liveupdate: Add test coverage for tmpfs preservation and retrieval

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] selftests: out-of-bounds read in ksft_print_msg format string
--

commit 6c97b421e43a12b89a960f6a03326dbad1153339
Author: David Matlack <dmatlack@google.com>

selftests: liveupdate: Add test coverage for tmpfs preservation and retrieval

This extends the multi-session live update test to verify preserving a
path-backed tmpfs file and retrieving its contents post-kexec. It also
verifies that retrieve argument validation errors are retryable and allow
a subsequent valid retrieve call to succeed.

> diff --git a/tools/testing/selftests/liveupdate/lib/lu_utils.c b/tools/testing/selftests/liveupdate/lib/lu_utils.c
> index 5c6f8bf80b297..1b1a556287d3a 100644
> --- a/tools/testing/selftests/liveupdate/lib/lu_utils.c
> +++ b/tools/testing/selftests/liveupdate/lib/lu_utils.c

[ ... ]

> +int restore_and_verify_tmpfs(int session_fd, int token, int fd,
> +			     const char *expected_data)
> +{

[ ... ]

> +	map = mmap(NULL, page_size, PROT_READ, MAP_SHARED, fd, 0);
> +	if (map == MAP_FAILED)
> +		return -errno;
> +
> +	if (expected_data && strcmp(expected_data, map) != 0) {
> +		ksft_print_msg("Data mismatch! Expected '%s', Got '%s'\n",
> +			       expected_data, (char *)map);

[Severity: Low]
Does this risk an out-of-bounds read when reporting a data mismatch?

The memory mapped at map is strictly bounded by page_size and not guaranteed
to be null-terminated. If the restored file contents lack a null terminator
due to corruption or a failed restore, the %s format specifier could read
past the page boundary and cause a crash.

Could this be printed with a length limit to ensure it safely prints only
what is mapped?

> +		munmap(map, page_size);
> +		return -EINVAL;
> +	}
> +
> +	munmap(map, page_size);
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015093816.2438942-1-pasha.tatashin@soleen.com?part=7