In order to cover this case, setting 'maxlen = 0', with the following explanation: EVIOCGKEY is executed from evdev_do_ioctl(), which is called from evdev_ioctl_handler(). evdev_ioctl_handler() is called from 2 functions, where by code coverage, only the first one is in use. ‘compat’ is given the value ‘0’ [1]. Thus, the condition [2] is always false. This means ‘len’ always equals a positive number [3] ‘maxlen’ in evdev_handle_get_val [4] is defined locally in evdev_do_ioctl() [5], and is sent in the variable 'size' [6]

[1] https://elixir.bootlin.com/linux/v6.2/source/drivers/input/evdev.c#L1281 [2] https://elixir.bootlin.com/linux/v6.2/source/drivers/input/evdev.c#L705 [3] https://elixir.bootlin.com/linux/v6.2/source/drivers/input/evdev.c#L707 [4] https://elixir.bootlin.com/linux/v6.2/source/drivers/input/evdev.c#L886 [5] https://elixir.bootlin.com/linux/v6.2/source/drivers/input/evdev.c#L1155 [6] https://elixir.bootlin.com/linux/v6.2/source/drivers/input/evdev.c#L1141

Signed-off-by: Dana Elfassy dangel101@gmail.com --- tools/testing/selftests/input/evioc-test.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)

diff --git a/tools/testing/selftests/input/evioc-test.c b/tools/testing/selftests/input/evioc-test.c index ad7b93fe39cf..b94de2ee5596 100644 --- a/tools/testing/selftests/input/evioc-test.c +++ b/tools/testing/selftests/input/evioc-test.c @@ -234,4 +234,23 @@ TEST(eviocsrep_set_repeat_settings) selftest_uinput_destroy(uidev); }

+TEST(eviocgkey_get_global_key_state) +{ + struct selftest_uinput *uidev; + int rep_values[2]; + int rc; + + memset(rep_values, 0, sizeof(rep_values)); + + rc = selftest_uinput_create_device(&uidev); + ASSERT_EQ(0, rc); + ASSERT_NE(NULL, uidev); + + /* ioctl to create the scenario where len > maxlen in bits_to_user() */ + rc = ioctl(uidev->evdev_fd, EVIOCGKEY(0), rep_values); + ASSERT_EQ(0, rc); + + selftest_uinput_destroy(uidev); +} + TEST_HARNESS_MAIN