diff options
| author | Michael Bommarito <michael.bommarito@gmail.com> | 2026-05-15 18:17:19 +0300 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-05-28 10:45:14 +0300 |
| commit | f31ce7e3154487ec1957b10b620b396b25760b82 (patch) | |
| tree | 9eb0b970e8ea659759e0b523987c199876943a98 /include/linux/workqueue_api.h | |
| parent | 1a1f055318d82e64485a6ff8420e5f70b4267998 (diff) | |
| download | linux-f31ce7e3154487ec1957b10b620b396b25760b82.tar.xz | |
wifi: mac80211: add KUnit coverage for negotiated TTLM parser
Add KUnit coverage for ieee80211_parse_neg_ttlm() to lock the sparse
link_map_presence layout against future regressions.
The sparse_presence_no_oob_read case crafts a negotiated TTLM element
with link_map_presence = BIT(0) | BIT(7) and bm_size = 2 in a buffer
sized exactly to the validated element length. Without the parser
fix this would read 14 bytes past the buffer when processing TID 7;
under KASAN that is a slab-out-of-bounds report.
The dense_presence_baseline case crafts a fully populated
link_map_presence = 0xff element to confirm that the cursor-advance
fix does not regress the path that was already correct.
Export ieee80211_parse_neg_ttlm via VISIBLE_IF_MAC80211_KUNIT so the
test can call it directly.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260515151719.1317659-3-michael.bommarito@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'include/linux/workqueue_api.h')
0 files changed, 0 insertions, 0 deletions
