Dan,

On 16/05/2022 11:54, Dan Carpenter wrote:

Hello Peter Ujfalusi,

The patch 066c67624d8c: "ASoC: SOF: ipc-msg-injector: Add support for IPC4 messages" from May 6, 2022, leads to the following Smatch static checker warning:

sound/soc/sof/sof-client-ipc-msg-injector.c:95 sof_msg_inject_ipc4_dfs_read() warn: userbuf overflow? is '8' <= 'count'

sound/soc/sof/sof-client-ipc-msg-injector.c 72 static ssize_t sof_msg_inject_ipc4_dfs_read(struct file *file, 73 char __user *buffer, 74 size_t count, loff_t *ppos) 75 { 76 struct sof_client_dev *cdev = file->private_data; 77 struct sof_msg_inject_priv *priv = cdev->data; 78 struct sof_ipc4_msg *ipc4_msg = priv->rx_buffer; 79 size_t remaining; 80 81 if (!ipc4_msg->header_u64 || !count || *ppos) 82 return 0; 83 84 remaining = sizeof(ipc4_msg->header_u64); 85 86 /* Only get large config have payload */ 87 if (SOF_IPC4_MSG_IS_MODULE_MSG(ipc4_msg->primary) && 88 (SOF_IPC4_MSG_TYPE_GET(ipc4_msg->primary) == SOF_IPC4_MOD_LARGE_CONFIG_GET)) 89 remaining += ipc4_msg->data_size; 90 91 if (count > remaining) 92 count = remaining; 93 94 /* copy the header first */ --> 95 if (copy_to_user(buffer, &ipc4_msg->header_u64, sizeof(ipc4_msg->header_u64))) 96 return -EFAULT; 97 98 *ppos += sizeof(ipc4_msg->header_u64); 99 remaining -= sizeof(ipc4_msg->header_u64); 100 101 if (!remaining) 102 return count; 103 104 if (remaining > ipc4_msg->data_size) 105 remaining = ipc4_msg->data_size; 106 107 /* Copy the payload */ 108 if (copy_to_user(buffer + *ppos, ipc4_msg->data_ptr, remaining)) ^^^^^^^^^^^^^^^ Potentially writing more than count bytes resulting in corrupting the user space memory.

Yes, this can happen. This is a validation, debugging module, used by developers and testers only so we did not had the case when the provided buffer would be smaller than the data we want to retrieve, but the issue is real and I have sent the fix now.

109                 return -EFAULT;
110 
111         *ppos += remaining;
112         return count;
113 }

regards, dan carpenter