Skip to content

Commit 0ecc8c0

Browse files
perexgsmb49
authored andcommitted
firmware: cs_dsp: Fix OOB memory read access in KUnit test
BugLink: https://bugs.launchpad.net/bugs/2120812 commit fe6446215bfad11cf3b446f38b28dc7708973c25 upstream. KASAN reported out of bounds access - cs_dsp_mock_bin_add_name_or_info(), because the source string length was rounded up to the allocation size. Cc: Simon Trimmer <simont@opensource.cirrus.com> Cc: Charles Keepax <ckeepax@opensource.cirrus.com> Cc: Richard Fitzgerald <rf@opensource.cirrus.com> Cc: patches@opensource.cirrus.com Cc: stable@vger.kernel.org Signed-off-by: Jaroslav Kysela <perex@perex.cz> Link: https://patch.msgid.link/20250523102102.1177151-1-perex@perex.cz Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com> Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Noah Wager <noah.wager@canonical.com> Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
1 parent 94a4a7b commit 0ecc8c0

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

drivers/firmware/cirrus/test/cs_dsp_mock_bin.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,10 +96,11 @@ static void cs_dsp_mock_bin_add_name_or_info(struct cs_dsp_mock_bin_builder *bui
9696

9797
if (info_len % 4) {
9898
/* Create a padded string with length a multiple of 4 */
99+
size_t copy_len = info_len;
99100
info_len = round_up(info_len, 4);
100101
tmp = kunit_kzalloc(builder->test_priv->test, info_len, GFP_KERNEL);
101102
KUNIT_ASSERT_NOT_ERR_OR_NULL(builder->test_priv->test, tmp);
102-
memcpy(tmp, info, info_len);
103+
memcpy(tmp, info, copy_len);
103104
info = tmp;
104105
}
105106

0 commit comments

Comments
 (0)