Hello Peter Ujfalusi,
The patch 066c67624d8c: "ASoC: SOF: ipc-msg-injector: Add support for
IPC4 messages" from May 6, 2022, leads to the following Smatch static
checker warning:
sound/soc/sof/sof-client-ipc-msg-injector.c:95 sof_msg_inject_ipc4_dfs_read()
warn: userbuf overflow? is '8' <= 'count'
sound/soc/sof/sof-client-ipc-msg-injector.c
72 static ssize_t sof_msg_inject_ipc4_dfs_read(struct file *file,
73 char __user *buffer,
74 size_t count, loff_t *ppos)
75 {
76 struct sof_client_dev *cdev = file->private_data;
77 struct sof_msg_inject_priv *priv = cdev->data;
78 struct sof_ipc4_msg *ipc4_msg = priv->rx_buffer;
79 size_t remaining;
80
81 if (!ipc4_msg->header_u64 || !count || *ppos)
82 return 0;
83
84 remaining = sizeof(ipc4_msg->header_u64);
85
86 /* Only get large config have payload */
87 if (SOF_IPC4_MSG_IS_MODULE_MSG(ipc4_msg->primary) &&
88 (SOF_IPC4_MSG_TYPE_GET(ipc4_msg->primary) == SOF_IPC4_MOD_LARGE_CONFIG_GET))
89 remaining += ipc4_msg->data_size;
90
91 if (count > remaining)
92 count = remaining;
93
94 /* copy the header first */
--> 95 if (copy_to_user(buffer, &ipc4_msg->header_u64, sizeof(ipc4_msg->header_u64)))
96 return -EFAULT;
97
98 *ppos += sizeof(ipc4_msg->header_u64);
99 remaining -= sizeof(ipc4_msg->header_u64);
100
101 if (!remaining)
102 return count;
103
104 if (remaining > ipc4_msg->data_size)
105 remaining = ipc4_msg->data_size;
106
107 /* Copy the payload */
108 if (copy_to_user(buffer + *ppos, ipc4_msg->data_ptr, remaining))
^^^^^^^^^^^^^^^
Potentially writing more than count bytes resulting in corrupting the
user space memory.
109 return -EFAULT;
110
111 *ppos += remaining;
112 return count;
113 }
regards,
dan carpenter
