Unverified Commit f4ba2ea5 authored by Jaroslav Kysela's avatar Jaroslav Kysela Committed by Mark Brown
Browse files

firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache) 



KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets().
The code uses mock_coeff_template.length_bytes (4 bytes) for register value
allocations. But later, this length is set to 8 bytes which causes
test code failures.

As fix, just remove the lenght override, keeping the original value 4
for all operations.

Cc: Simon Trimmer <simont@opensource.cirrus.com>
Cc: Charles Keepax <ckeepax@opensource.cirrus.com>
Cc: Richard Fitzgerald <rf@opensource.cirrus.com>
Cc: patches@opensource.cirrus.com
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJaroslav Kysela <perex@perex.cz>
Reviewed-by: default avatarRichard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20250523154151.1252585-1-perex@perex.cz


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent d979b783

drivers/firmware/cirrus/test/cs_dsp_test_control_cache.c

+0 −1
Original line number Diff line number Diff line
@@ -776,7 +776,6 @@ static void cs_dsp_ctl_cache_init_multiple_offsets(struct kunit *test) 
					      "dummyalg", NULL);



	/* Create controls identical except for offset */

	def.length_bytes = 8;

	def.offset_dsp_words = 0;

	def.shortname = "CtlA";

	cs_dsp_mock_wmfw_add_coeff_desc(local->wmfw_builder, &def);