diff options
| author |   Jaroslav Kysela <perex@perex.cz> | 2025-05-23 17:58:14 +0200 |
|---|---|---|
| committer |   Mark Brown <broonie@kernel.org> | 2025-05-26 11:33:51 +0100 |
| commit | d979b783d61f7f1f95664031b71a33afc74627b2 (patch) | |
| tree | 8cc46dac1b021fd14761eeec16570e604ccaed4c | |
| parent | ASoC: codecs: add support for ES8375 (diff) | |
| download | wireguard-linux-d979b783d61f7f1f95664031b71a33afc74627b2.tar.xz wireguard-linux-d979b783d61f7f1f95664031b71a33afc74627b2.zip | |
firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)
KASAN reported out of bounds access - cs_dsp_mock_wmfw_add_info(),
because the source string length was rounded up to the allocation size.
Cc: Simon Trimmer <simont@opensource.cirrus.com>
Cc: Charles Keepax <ckeepax@opensource.cirrus.com>
Cc: Richard Fitzgerald <rf@opensource.cirrus.com>
Cc: patches@opensource.cirrus.com
Cc: stable@vger.kernel.org
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20250523155814.1256762-1-perex@perex.cz
Signed-off-by: Mark Brown <broonie@kernel.org>
| -rw-r--r-- | drivers/firmware/cirrus/test/cs_dsp_mock_wmfw.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/firmware/cirrus/test/cs_dsp_mock_wmfw.c b/drivers/firmware/cirrus/test/cs_dsp_mock_wmfw.c index 934d40a4d709..5e1d5a810afe 100644 --- a/drivers/firmware/cirrus/test/cs_dsp_mock_wmfw.c +++ b/drivers/firmware/cirrus/test/cs_dsp_mock_wmfw.c @@ -133,10 +133,11 @@ void cs_dsp_mock_wmfw_add_info(struct cs_dsp_mock_wmfw_builder *builder, if (info_len % 4) { /* Create a padded string with length a multiple of 4 */ + size_t copy_len = info_len; info_len = round_up(info_len, 4); tmp = kunit_kzalloc(builder->test_priv->test, info_len, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(builder->test_priv->test, tmp); - memcpy(tmp, info, info_len); + memcpy(tmp, info, copy_len); info = tmp; } |