6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela perex@perex.cz
commit f4ba2ea57da51d616b689c4b8826c517ff5a8523 upstream.
KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets(). The code uses mock_coeff_template.length_bytes (4 bytes) for register value allocations. But later, this length is set to 8 bytes which causes test code failures.
As fix, just remove the lenght override, keeping the original value 4 for all operations.
Cc: Simon Trimmer simont@opensource.cirrus.com Cc: Charles Keepax ckeepax@opensource.cirrus.com Cc: Richard Fitzgerald rf@opensource.cirrus.com Cc: patches@opensource.cirrus.com Cc: stable@vger.kernel.org Signed-off-by: Jaroslav Kysela perex@perex.cz Reviewed-by: Richard Fitzgerald rf@opensource.cirrus.com Link: https://patch.msgid.link/20250523154151.1252585-1-perex@perex.cz Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/firmware/cirrus/test/cs_dsp_test_control_cache.c | 1 - 1 file changed, 1 deletion(-)
--- a/drivers/firmware/cirrus/test/cs_dsp_test_control_cache.c +++ b/drivers/firmware/cirrus/test/cs_dsp_test_control_cache.c @@ -776,7 +776,6 @@ static void cs_dsp_ctl_cache_init_multip "dummyalg", NULL);
/* Create controls identical except for offset */ - def.length_bytes = 8; def.offset_dsp_words = 0; def.shortname = "CtlA"; cs_dsp_mock_wmfw_add_coeff_desc(local->wmfw_builder, &def);