From: Jaroslav Kysela Date: Fri, 23 May 2025 15:41:51 +0000 (+0200) Subject: firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache) X-Git-Tag: v6.16-rc1~13^2^2~11 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=f4ba2ea57da51d616b689c4b8826c517ff5a8523;p=linux-block.git firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache) KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets(). The code uses mock_coeff_template.length_bytes (4 bytes) for register value allocations. But later, this length is set to 8 bytes which causes test code failures. As fix, just remove the lenght override, keeping the original value 4 for all operations. Cc: Simon Trimmer Cc: Charles Keepax Cc: Richard Fitzgerald Cc: patches@opensource.cirrus.com Cc: stable@vger.kernel.org Signed-off-by: Jaroslav Kysela Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20250523154151.1252585-1-perex@perex.cz Signed-off-by: Mark Brown --- diff --git a/drivers/firmware/cirrus/test/cs_dsp_test_control_cache.c b/drivers/firmware/cirrus/test/cs_dsp_test_control_cache.c index 83386cc978e3..ebca3a4ab0f1 100644 --- a/drivers/firmware/cirrus/test/cs_dsp_test_control_cache.c +++ b/drivers/firmware/cirrus/test/cs_dsp_test_control_cache.c @@ -776,7 +776,6 @@ static void cs_dsp_ctl_cache_init_multiple_offsets(struct kunit *test) "dummyalg", NULL); /* Create controls identical except for offset */ - def.length_bytes = 8; def.offset_dsp_words = 0; def.shortname = "CtlA"; cs_dsp_mock_wmfw_add_coeff_desc(local->wmfw_builder, &def);