tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master head: 92edc4aef86780a8ad01b092c6d6630bb3cb423d commit: 20224d715a882210428ea62bba93f1bc4a0afe23 [2760/5794] drm/msm/submit: Move copy_from_user ahead of locking bos config: arm64-randconfig-r002-20201113 (attached as .config) compiler: clang version 12.0.0 (https://github.com/llvm/llvm-project 9a85643cd357e412cff69067bb5c4840e228c2ab) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install arm64 cross compiling tool for clang build # apt-get install binutils-aarch64-linux-gnu # https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commi... git remote add linux-next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git git fetch --no-tags linux-next master git checkout 20224d715a882210428ea62bba93f1bc4a0afe23 # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm64 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; All warnings (new ones prefixed by >>): if (sz == SIZE_MAX) { ~~ ^ ~~~~~~~~ 1 warning generated. vim +202 drivers/gpu/drm/msm/msm_gem_submit.c 157 158 static int submit_lookup_cmds(struct msm_gem_submit *submit, 159 struct drm_msm_gem_submit *args, struct drm_file *file) 160 { 161 unsigned i, sz; 162 int ret = 0; 163 164 for (i = 0; i < args->nr_cmds; i++) { 165 struct drm_msm_gem_submit_cmd submit_cmd; 166 void __user *userptr = 167 u64_to_user_ptr(args->cmds + (i * sizeof(submit_cmd))); 168 169 ret = copy_from_user(&submit_cmd, userptr, sizeof(submit_cmd)); 170 if (ret) { 171 ret = -EFAULT; 172 goto out; 173 } 174 175 /* validate input from userspace: */ 176 switch (submit_cmd.type) { 177 case MSM_SUBMIT_CMD_BUF: 178 case MSM_SUBMIT_CMD_IB_TARGET_BUF: 179 case MSM_SUBMIT_CMD_CTX_RESTORE_BUF: 180 break; 181 default: 182 DRM_ERROR("invalid type: %08x\n", submit_cmd.type); 183 return -EINVAL; 184 } 185 186 if (submit_cmd.size % 4) { 187 DRM_ERROR("non-aligned cmdstream buffer size: %u\n", 188 submit_cmd.size); 189 ret = -EINVAL; 190 goto out; 191 } 192 193 submit->cmd[i].type = submit_cmd.type; 194 submit->cmd[i].size = submit_cmd.size / 4; 195 submit->cmd[i].offset = submit_cmd.submit_offset / 4; 196 submit->cmd[i].idx = submit_cmd.submit_idx; 197 submit->cmd[i].nr_relocs = submit_cmd.nr_relocs; 198 199 sz = array_size(submit_cmd.nr_relocs, 200 sizeof(struct drm_msm_gem_submit_reloc)); 201 /* check for overflow: */ 203 ret = -ENOMEM; 204 goto out; 205 } 206 submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL); 207 ret = copy_from_user(submit->cmd[i].relocs, userptr, sz); 208 if (ret) { 209 ret = -EFAULT; 210 goto out; 211 } 212 } 213 214 out: 215 return ret; 216 } 217 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org