From: Jaroslav Kysela Date: Fri, 23 May 2025 10:21:02 +0000 (+0200) Subject: firmware: cs_dsp: Fix OOB memory read access in KUnit test X-Git-Tag: v6.16-rc1~13^2~6^2~1 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=fe6446215bfad11cf3b446f38b28dc7708973c25;p=linux-block.git firmware: cs_dsp: Fix OOB memory read access in KUnit test KASAN reported out of bounds access - cs_dsp_mock_bin_add_name_or_info(), because the source string length was rounded up to the allocation size. Cc: Simon Trimmer Cc: Charles Keepax Cc: Richard Fitzgerald Cc: patches@opensource.cirrus.com Cc: stable@vger.kernel.org Signed-off-by: Jaroslav Kysela Link: https://patch.msgid.link/20250523102102.1177151-1-perex@perex.cz Reviewed-by: Richard Fitzgerald Signed-off-by: Mark Brown --- diff --git a/drivers/firmware/cirrus/test/cs_dsp_mock_bin.c b/drivers/firmware/cirrus/test/cs_dsp_mock_bin.c index 80e67474ddb8..3f8777ee4dc0 100644 --- a/drivers/firmware/cirrus/test/cs_dsp_mock_bin.c +++ b/drivers/firmware/cirrus/test/cs_dsp_mock_bin.c @@ -96,10 +96,11 @@ static void cs_dsp_mock_bin_add_name_or_info(struct cs_dsp_mock_bin_builder *bui if (info_len % 4) { /* Create a padded string with length a multiple of 4 */ + size_t copy_len = info_len; info_len = round_up(info_len, 4); tmp = kunit_kzalloc(builder->test_priv->test, info_len, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(builder->test_priv->test, tmp); - memcpy(tmp, info, info_len); + memcpy(tmp, info, copy_len); info = tmp; }