Skip to content

Commit fe64462

Browse files
perexgbroonie
authored andcommitted
firmware: cs_dsp: Fix OOB memory read access in KUnit test
KASAN reported out of bounds access - cs_dsp_mock_bin_add_name_or_info(), because the source string length was rounded up to the allocation size. Cc: Simon Trimmer <simont@opensource.cirrus.com> Cc: Charles Keepax <ckeepax@opensource.cirrus.com> Cc: Richard Fitzgerald <rf@opensource.cirrus.com> Cc: patches@opensource.cirrus.com Cc: stable@vger.kernel.org Signed-off-by: Jaroslav Kysela <perex@perex.cz> Link: https://patch.msgid.link/20250523102102.1177151-1-perex@perex.cz Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com> Signed-off-by: Mark Brown <broonie@kernel.org>
1 parent 7ce3bf7 commit fe64462

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

drivers/firmware/cirrus/test/cs_dsp_mock_bin.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,10 +96,11 @@ static void cs_dsp_mock_bin_add_name_or_info(struct cs_dsp_mock_bin_builder *bui
9696

9797
if (info_len % 4) {
9898
/* Create a padded string with length a multiple of 4 */
99+
size_t copy_len = info_len;
99100
info_len = round_up(info_len, 4);
100101
tmp = kunit_kzalloc(builder->test_priv->test, info_len, GFP_KERNEL);
101102
KUNIT_ASSERT_NOT_ERR_OR_NULL(builder->test_priv->test, tmp);
102-
memcpy(tmp, info, info_len);
103+
memcpy(tmp, info, copy_len);
103104
info = tmp;
104105
}
105106

0 commit comments

Comments
 (0)