[bug report] ASoC: SOF: ipc-msg-injector: Add support for IPC4 messages

[Dan Carpenter]

Hello Peter Ujfalusi,

The patch 066c67624d8c: "ASoC: SOF: ipc-msg-injector: Add support for
IPC4 messages" from May 6, 2022, leads to the following Smatch static
checker warning:

	sound/soc/sof/sof-client-ipc-msg-injector.c:95 sof_msg_inject_ipc4_dfs_read()
	warn: userbuf overflow? is '8' <= 'count'

sound/soc/sof/sof-client-ipc-msg-injector.c
    72 static ssize_t sof_msg_inject_ipc4_dfs_read(struct file *file,
    73                                             char __user *buffer,
    74                                             size_t count, loff_t *ppos)
    75 {
    76         struct sof_client_dev *cdev = file->private_data;
    77         struct sof_msg_inject_priv *priv = cdev->data;
    78         struct sof_ipc4_msg *ipc4_msg = priv->rx_buffer;
    79         size_t remaining;
    80 
    81         if (!ipc4_msg->header_u64 || !count || *ppos)
    82                 return 0;
    83 
    84         remaining = sizeof(ipc4_msg->header_u64);
    85 
    86         /* Only get large config have payload */
    87         if (SOF_IPC4_MSG_IS_MODULE_MSG(ipc4_msg->primary) &&
    88             (SOF_IPC4_MSG_TYPE_GET(ipc4_msg->primary) == SOF_IPC4_MOD_LARGE_CONFIG_GET))
    89                 remaining += ipc4_msg->data_size;
    90 
    91         if (count > remaining)
    92                 count = remaining;
    93 
    94         /* copy the header first */
--> 95         if (copy_to_user(buffer, &ipc4_msg->header_u64, sizeof(ipc4_msg->header_u64)))
    96                 return -EFAULT;
    97 
    98         *ppos += sizeof(ipc4_msg->header_u64);
    99         remaining -= sizeof(ipc4_msg->header_u64);
    100 
    101         if (!remaining)
    102                 return count;
    103 
    104         if (remaining > ipc4_msg->data_size)
    105                 remaining = ipc4_msg->data_size;
    106 
    107         /* Copy the payload */
    108         if (copy_to_user(buffer + *ppos, ipc4_msg->data_ptr, remaining))
                                 ^^^^^^^^^^^^^^^
Potentially writing more than count bytes resulting in corrupting the
user space memory.

    109                 return -EFAULT;
    110 
    111         *ppos += remaining;
    112         return count;
    113 }

regards,
dan carpenter