tree: https://github.com/0day-ci/linux/commits/UPDATE-20220120-113516/guangming... head: d6d3f09d899553b1100b195a91a8f718d1bd6bc2 commit: d6d3f09d899553b1100b195a91a8f718d1bd6bc2 dma-buf: system_heap: Add a size check for allocation date: 3 hours ago config: x86_64-randconfig-a001-20220117 (https://download.01.org/0day-ci/archive/20220120/202201201459.LzpimBE3-lk...) compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project f7b7138a62648f4019c55e4671682af1f851f295) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/0day-ci/linux/commit/d6d3f09d899553b1100b195a91a8f718d... git remote add linux-review https://github.com/0day-ci/linux git fetch --no-tags linux-review UPDATE-20220120-113516/guangming-cao-mediatek-com/dma-buf-dma-heap-Add-a-size-limitation-for-allocation/20211217-174135 git checkout d6d3f09d899553b1100b195a91a8f718d1bd6bc2 # save the config file to linux build tree mkdir build_dir COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/dma-buf/heaps/ If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; All warnings (new ones prefixed by >>): return -EINVAL; ^~~~~~~ 1 warning generated. vim +357 drivers/dma-buf/heaps/system_heap.c 334 335 static struct dma_buf *system_heap_allocate(struct dma_heap *heap, 336 unsigned long len, 337 unsigned long fd_flags, 338 unsigned long heap_flags) 339 { 340 struct system_heap_buffer *buffer; 341 DEFINE_DMA_BUF_EXPORT_INFO(exp_info); 342 unsigned long size_remaining = len; 343 unsigned int max_order = orders[0]; 344 struct dma_buf *dmabuf; 345 struct sg_table *table; 346 struct scatterlist *sg; 347 struct list_head pages; 348 struct page *page, *tmp_page; 349 int i, ret = -ENOMEM; 350 351 /* 352 * Size check. The "len" should be less than totalram since system_heap 353 * memory is comes from system. Adding check here can prevent consuming 354 * too much time for invalid allocations. 355 */ 356 if (len >> PAGE_SHIFT > totalram_pages()) 358 buffer = kzalloc(sizeof(*buffer), GFP_KERNEL); 359 if (!buffer) 360 return ERR_PTR(-ENOMEM); 361 362 INIT_LIST_HEAD(&buffer->attachments); 363 mutex_init(&buffer->lock); 364 buffer->heap = heap; 365 buffer->len = len; 366 367 INIT_LIST_HEAD(&pages); 368 i = 0; 369 while (size_remaining > 0) { 370 /* 371 * Avoid trying to allocate memory if the process 372 * has been killed by SIGKILL 373 */ 374 if (fatal_signal_pending(current)) { 375 ret = -EINTR; 376 goto free_buffer; 377 } 378 379 page = alloc_largest_available(size_remaining, max_order); 380 if (!page) 381 goto free_buffer; 382 383 list_add_tail(&page->lru, &pages); 384 size_remaining -= page_size(page); 385 max_order = compound_order(page); 386 i++; 387 } 388 389 table = &buffer->sg_table; 390 if (sg_alloc_table(table, i, GFP_KERNEL)) 391 goto free_buffer; 392 393 sg = table->sgl; 394 list_for_each_entry_safe(page, tmp_page, &pages, lru) { 395 sg_set_page(sg, page, page_size(page), 0); 396 sg = sg_next(sg); 397 list_del(&page->lru); 398 } 399 400 /* create the dmabuf */ 401 exp_info.exp_name = dma_heap_get_name(heap); 402 exp_info.ops = &system_heap_buf_ops; 403 exp_info.size = buffer->len; 404 exp_info.flags = fd_flags; 405 exp_info.priv = buffer; 406 dmabuf = dma_buf_export(&exp_info); 407 if (IS_ERR(dmabuf)) { 408 ret = PTR_ERR(dmabuf); 409 goto free_pages; 410 } 411 return dmabuf; 412 413 free_pages: 414 for_each_sgtable_sg(table, sg, i) { 415 struct page *p = sg_page(sg); 416 417 __free_pages(p, compound_order(p)); 418 } 419 sg_free_table(table); 420 free_buffer: 421 list_for_each_entry_safe(page, tmp_page, &pages, lru) 422 __free_pages(page, compound_order(page)); 423 kfree(buffer); 424 425 return ERR_PTR(ret); 426 } 427 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org