drivers/tee/tee_shm.c
tree:   https://github.com/ammarfaizi2/linux-block stable/linux-stable-rc/queue/5.4
head:   0fba1e2c641159e7be376caca88e26bca49d72e5
commit: dabfd6b7c4c6037a52f0884540f0cc8e19b2f5c5 [285/287] tee: add overflow check in register_shm_helper()
config: arm-buildonly-randconfig-r001-20220819
compiler: arm-linux-gnueabi-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/ammarfaizi2/linux-block/commit/dabfd6b7c4c6037a52f0884540f0cc8e19b2f5c5
        git remote add ammarfaizi2-block https://github.com/ammarfaizi2/linux-block
        git fetch --no-tags ammarfaizi2-block stable/linux-stable-rc/queue/5.4
        git checkout dabfd6b7c4c6037a52f0884540f0cc8e19b2f5c5
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=arm SHELL=/bin/bash drivers/tee/

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   drivers/tee/tee_shm.c: In function 'tee_shm_register':
>> drivers/tee/tee_shm.c:242:14: error: implicit declaration of function 'access_ok' [-Werror=implicit-function-declaration]
     242 |         if (!access_ok((void __user *)addr, length))
         |              ^~~~~~~~~
   cc1: some warnings being treated as errors


vim +/access_ok +242 drivers/tee/tee_shm.c

   168	
   169	struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
   170					 size_t length, u32 flags)
   171	{
   172		struct tee_device *teedev = ctx->teedev;
   173		const u32 req_flags = TEE_SHM_DMA_BUF | TEE_SHM_USER_MAPPED;
   174		struct tee_shm *shm;
   175		void *ret;
   176		int rc;
   177		int num_pages;
   178		unsigned long start;
   179	
   180		if (flags != req_flags)
   181			return ERR_PTR(-ENOTSUPP);
   182	
   183		if (!tee_device_get(teedev))
   184			return ERR_PTR(-EINVAL);
   185	
   186		if (!teedev->desc->ops->shm_register ||
   187		    !teedev->desc->ops->shm_unregister) {
   188			tee_device_put(teedev);
   189			return ERR_PTR(-ENOTSUPP);
   190		}
   191	
   192		teedev_ctx_get(ctx);
   193	
   194		shm = kzalloc(sizeof(*shm), GFP_KERNEL);
   195		if (!shm) {
   196			ret = ERR_PTR(-ENOMEM);
   197			goto err;
   198		}
   199	
   200		refcount_set(&shm->refcount, 1);
   201		shm->flags = flags | TEE_SHM_REGISTER;
   202		shm->teedev = teedev;
   203		shm->ctx = ctx;
   204		shm->id = -1;
   205		addr = untagged_addr(addr);
   206		start = rounddown(addr, PAGE_SIZE);
   207		shm->offset = addr - start;
   208		shm->size = length;
   209		num_pages = (roundup(addr + length, PAGE_SIZE) - start) / PAGE_SIZE;
   210		shm->pages = kcalloc(num_pages, sizeof(*shm->pages), GFP_KERNEL);
   211		if (!shm->pages) {
   212			ret = ERR_PTR(-ENOMEM);
   213			goto err;
   214		}
   215	
   216		rc = get_user_pages_fast(start, num_pages, FOLL_WRITE, shm->pages);
   217		if (rc > 0)
   218			shm->num_pages = rc;
   219		if (rc != num_pages) {
   220			if (rc >= 0)
   221				rc = -ENOMEM;
   222			ret = ERR_PTR(rc);
   223			goto err;
   224		}
   225	
   226		mutex_lock(&teedev->mutex);
   227		shm->id = idr_alloc(&teedev->idr, shm, 1, 0, GFP_KERNEL);
   228		mutex_unlock(&teedev->mutex);
   229	
   230		if (shm->id < 0) {
   231			ret = ERR_PTR(shm->id);
   232			goto err;
   233		}
   234	
   235		rc = teedev->desc->ops->shm_register(ctx, shm, shm->pages,
   236						     shm->num_pages, start);
   237		if (rc) {
   238			ret = ERR_PTR(rc);
   239			goto err;
   240		}
   241	
 > 242		if (!access_ok((void __user *)addr, length))
   243			return ERR_PTR(-EFAULT);
   244	
   245		mutex_lock(&teedev->mutex);
   246		list_add_tail(&shm->link, &ctx->list_shm);
   247		mutex_unlock(&teedev->mutex);
   248	
   249		return shm;
   250	err:
   251		if (shm) {
   252			size_t n;
   253	
   254			if (shm->id >= 0) {
   255				mutex_lock(&teedev->mutex);
   256				idr_remove(&teedev->idr, shm->id);
   257				mutex_unlock(&teedev->mutex);
   258			}
   259			if (shm->pages) {
   260				for (n = 0; n < shm->num_pages; n++)
   261					put_page(shm->pages[n]);
   262				kfree(shm->pages);
   263			}
   264		}
   265		kfree(shm);
   266		teedev_ctx_put(ctx);
   267		tee_device_put(teedev);
   268		return ret;
   269	}
   270	EXPORT_SYMBOL_GPL(tee_shm_register);
   271	

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp