1:50 a.m.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: 92edc4aef86780a8ad01b092c6d6630bb3cb423d
commit: 20224d715a882210428ea62bba93f1bc4a0afe23 [2760/5794] drm/msm/submit: Move
copy_from_user ahead of locking bos
config: arm64-randconfig-r002-20201113 (attached as .config)
compiler: clang version 12.0.0 (https://github.com/llvm/llvm-project
9a85643cd357e412cff69067bb5c4840e228c2ab)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O
~/bin/make.cross
chmod +x ~/bin/make.cross
# install arm64 cross compiling tool for clang build
# apt-get install binutils-aarch64-linux-gnu
#
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commi...
git remote add linux-next
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
git fetch --no-tags linux-next master
git checkout 20224d715a882210428ea62bba93f1bc4a0afe23
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
All warnings (new ones prefixed by >>):
> drivers/gpu/drm/msm/msm_gem_submit.c:202:10: warning: result of
comparison of constant 18446744073709551615 with expression of type 'unsigned int'
is always false [-Wtautological-constant-out-of-range-compare]
if
(sz == SIZE_MAX) {
~~ ^ ~~~~~~~~
1 warning generated.
vim +202 drivers/gpu/drm/msm/msm_gem_submit.c
157
158 static int submit_lookup_cmds(struct msm_gem_submit *submit,
159 struct drm_msm_gem_submit *args, struct drm_file *file)
160 {
161 unsigned i, sz;
162 int ret = 0;
163
164 for (i = 0; i < args->nr_cmds; i++) {
165 struct drm_msm_gem_submit_cmd submit_cmd;
166 void __user *userptr =
167 u64_to_user_ptr(args->cmds + (i * sizeof(submit_cmd)));
168
169 ret = copy_from_user(&submit_cmd, userptr, sizeof(submit_cmd));
170 if (ret) {
171 ret = -EFAULT;
172 goto out;
173 }
174
175 /* validate input from userspace: */
176 switch (submit_cmd.type) {
177 case MSM_SUBMIT_CMD_BUF:
178 case MSM_SUBMIT_CMD_IB_TARGET_BUF:
179 case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
180 break;
181 default:
182 DRM_ERROR("invalid type: %08x\n", submit_cmd.type);
183 return -EINVAL;
184 }
185
186 if (submit_cmd.size % 4) {
187 DRM_ERROR("non-aligned cmdstream buffer size: %u\n",
188 submit_cmd.size);
189 ret = -EINVAL;
190 goto out;
191 }
192
193 submit->cmd[i].type = submit_cmd.type;
194 submit->cmd[i].size = submit_cmd.size / 4;
195 submit->cmd[i].offset = submit_cmd.submit_offset / 4;
196 submit->cmd[i].idx = submit_cmd.submit_idx;
197 submit->cmd[i].nr_relocs = submit_cmd.nr_relocs;
198
199 sz = array_size(submit_cmd.nr_relocs,
200 sizeof(struct drm_msm_gem_submit_reloc));
201 /* check for overflow: */
202 if (sz == SIZE_MAX) {
203 ret = -ENOMEM;
204 goto out;
205 }
206 submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL);
207 ret = copy_from_user(submit->cmd[i].relocs, userptr, sz);
208 if (ret) {
209 ret = -EFAULT;
210 goto out;
211 }
212 }
213
214 out:
215 return ret;
216 }
217
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org