Skip to content

Commit d979b78

Browse files
perexgbroonie
authored andcommitted
firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)
KASAN reported out of bounds access - cs_dsp_mock_wmfw_add_info(), because the source string length was rounded up to the allocation size. Cc: Simon Trimmer <[email protected]> Cc: Charles Keepax <[email protected]> Cc: Richard Fitzgerald <[email protected]> Cc: [email protected] Cc: [email protected] Signed-off-by: Jaroslav Kysela <[email protected]> Reviewed-by: Richard Fitzgerald <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Mark Brown <[email protected]>
1 parent 43a38a0 commit d979b78

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

drivers/firmware/cirrus/test/cs_dsp_mock_wmfw.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,10 +133,11 @@ void cs_dsp_mock_wmfw_add_info(struct cs_dsp_mock_wmfw_builder *builder,
133133

134134
if (info_len % 4) {
135135
/* Create a padded string with length a multiple of 4 */
136+
size_t copy_len = info_len;
136137
info_len = round_up(info_len, 4);
137138
tmp = kunit_kzalloc(builder->test_priv->test, info_len, GFP_KERNEL);
138139
KUNIT_ASSERT_NOT_ERR_OR_NULL(builder->test_priv->test, tmp);
139-
memcpy(tmp, info, info_len);
140+
memcpy(tmp, info, copy_len);
140141
info = tmp;
141142
}
142143

0 commit comments

Comments
 (0)