Unverified Commit d979b783 authored by Jaroslav Kysela's avatar Jaroslav Kysela Committed by Mark Brown
Browse files

firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info) 



KASAN reported out of bounds access - cs_dsp_mock_wmfw_add_info(),
because the source string length was rounded up to the allocation size.

Cc: Simon Trimmer <simont@opensource.cirrus.com>
Cc: Charles Keepax <ckeepax@opensource.cirrus.com>
Cc: Richard Fitzgerald <rf@opensource.cirrus.com>
Cc: patches@opensource.cirrus.com
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJaroslav Kysela <perex@perex.cz>
Reviewed-by: default avatarRichard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20250523155814.1256762-1-perex@perex.cz


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 43a38a0f

drivers/firmware/cirrus/test/cs_dsp_mock_wmfw.c

+2 −1
Original line number Diff line number Diff line
@@ -133,10 +133,11 @@ void cs_dsp_mock_wmfw_add_info(struct cs_dsp_mock_wmfw_builder *builder, 


	if (info_len % 4) {

		/* Create a padded string with length a multiple of 4 */

		size_t copy_len = info_len;

		info_len = round_up(info_len, 4);

		tmp = kunit_kzalloc(builder->test_priv->test, info_len, GFP_KERNEL);

		KUNIT_ASSERT_NOT_ERR_OR_NULL(builder->test_priv->test, tmp);

		memcpy(tmp, info, info_len);

		memcpy(tmp, info, copy_len);

		info = tmp;

	}