Skip to content

Commit f4ba2ea

Browse files
perexgbroonie
authored andcommitted
firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)
KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets(). The code uses mock_coeff_template.length_bytes (4 bytes) for register value allocations. But later, this length is set to 8 bytes which causes test code failures. As fix, just remove the lenght override, keeping the original value 4 for all operations. Cc: Simon Trimmer <simont@opensource.cirrus.com> Cc: Charles Keepax <ckeepax@opensource.cirrus.com> Cc: Richard Fitzgerald <rf@opensource.cirrus.com> Cc: patches@opensource.cirrus.com Cc: stable@vger.kernel.org Signed-off-by: Jaroslav Kysela <perex@perex.cz> Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20250523154151.1252585-1-perex@perex.cz Signed-off-by: Mark Brown <broonie@kernel.org>
1 parent d979b78 commit f4ba2ea

File tree

1 file changed

+0
-1
lines changed

1 file changed

+0
-1
lines changed

drivers/firmware/cirrus/test/cs_dsp_test_control_cache.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -776,7 +776,6 @@ static void cs_dsp_ctl_cache_init_multiple_offsets(struct kunit *test)
776776
"dummyalg", NULL);
777777

778778
/* Create controls identical except for offset */
779-
def.length_bytes = 8;
780779
def.offset_dsp_words = 0;
781780
def.shortname = "CtlA";
782781
cs_dsp_mock_wmfw_add_coeff_desc(local->wmfw_builder, &def);

0 commit comments

Comments
 (0)