[LTP] [PATCH v3] read_all: Fix buffer too small for long paths

[Michael Menasherov]

Hi Cyril
Thanks for explaining the problem with the code. I took a better look at it.
How about checking before the write instead:

      while (q->data[i]) {
          if (j >= BUFFER_SIZE - 1)
              tst_brk(TBROK, "Buffer is too small for path");

          q->popped[j++] = q->data[i];
          i = (i + 1) % QUEUE_SIZE;
      }
      q->popped[j] = '\0';

  j can never reach BUFFER_SIZE without TBROK, and PATH_MAX - 1 paths
  still fit. Does this look good to you?

  Thanks,
  Michael Menasherov.

On Tue, Sep 15, 2026 at 3:57 PM Cyril Hrubis <chrubis@suse.cz> wrote:

> Hi!
> > diff --git a/testcases/kernel/fs/read_all/read_all.c
> b/testcases/kernel/fs/read_all/read_all.c
> > index 5720ffb99..ec9454fc9 100644
> > --- a/testcases/kernel/fs/read_all/read_all.c
> > +++ b/testcases/kernel/fs/read_all/read_all.c
> > @@ -51,8 +51,8 @@
> >  #include "tst_timer.h"
> >
> >  #define QUEUE_SIZE 16384
> > -#define BUFFER_SIZE 1024
> > -#define MAX_PATH 4096
> > +#define BUFFER_SIZE PATH_MAX
> > +#define MAX_PATH PATH_MAX
> >  #define MAX_DISPLAY 40
>
> This part looks good.
>
> >  struct queue {
> > @@ -131,7 +131,7 @@ static int queue_pop(struct queue *q)
> >       while (q->data[i]) {
> >               q->popped[j] = q->data[i];
> >
> > -             if (++j >= BUFFER_SIZE - 1)
> > +             if (++j >= BUFFER_SIZE)
> >                       tst_brk(TBROK, "Buffer is too small for path");
> >
> >                i = (i + 1) % QUEUE_SIZE;
>
> However here we do:
>
> q->popped[j] = '\0';
>
> So j must be at most BUFFER_SIZE-1 and with the change above j may end
> up equal to BUFFER_SIZE and we will land off by one in the array.
>
> --
> Cyril Hrubis
> chrubis@suse.cz
>
>

-- 

Michael Menasherov

Software Quality Engineer - Automotive Kernel

Red Hat <https://www.redhat.com/>
<https://www.redhat.com/>