[rclaveau:b4/add-adla_npu-t7-vim4 11/12] drivers/accel/adla/adla_job.c:251:15-22: WARNING opportunity for memdup_user

[kernel test robot <lkp@intel.com>]

tree:   https://github.com/rclaveau-tech/linux-khadas.git b4/add-adla_npu-t7-vim4
head:   6a683103bab0575a7d69e0120848527b5c9e1fba
commit: 119db09982ec102b61dafe617a5c1595bea127e1 [11/12] accel: adla: Add driver for Amlogic NPU
config: openrisc-randconfig-r053-20260704 (https://download.01.org/0day-ci/archive/20260704/202607041042.bTOQaUv8-lkp@intel.com/config)
compiler: or1k-linux-gcc (GCC) 12.5.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202607041042.bTOQaUv8-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> drivers/accel/adla/adla_job.c:251:15-22: WARNING opportunity for memdup_user

vim +251 drivers/accel/adla/adla_job.c

   228	
   229	int adla_ioctl_submit(struct drm_device *dev, void *data, struct drm_file *filp) {
   230		struct drm_adla_submit *submit = data;
   231		struct adla_device *adla = container_of(dev, struct adla_device, drm);
   232		struct adla_file *afile = filp->driver_priv;
   233		struct adla_job *job;
   234		int ret = 0;
   235		u32 id;
   236	
   237		if (/*submit->config_size == 0 || */submit->config_size > SZ_1M)
   238			return -EINVAL;
   239	
   240		job = kzalloc(sizeof (*job), GFP_KERNEL);
   241		if (!job)
   242			return -ENOMEM;
   243	
   244		job->adla = adla;
   245		job->output_modules = submit->output_modules;
   246		job->active_modules = submit->active_modules;
   247		job->fence_modules = submit->fence_modules;
   248		job->dep = submit->dep;
   249	
   250		job->config_size = submit->config_size;
 > 251		job->config = kmalloc(submit->config_size, GFP_KERNEL);
   252		if (!job->config) { ret = -ENOMEM; goto err_free_job; }
   253	
   254		if (copy_from_user(job->config, u64_to_user_ptr(submit->config_ptr),
   255				   submit->config_size)) {
   256			ret = -EFAULT;
   257			goto err_free_config;
   258		}
   259	
   260		job->fixup_count = submit->fixup_count;
   261		if (job->fixup_count) {
   262			job->fixups = kmalloc_array(job->fixup_count,
   263						    sizeof(struct adla_fixup), GFP_KERNEL);
   264			if (!job->fixups) { ret = -ENOMEM; goto err_free_config; }
   265	
   266			if (copy_from_user(job->fixups, u64_to_user_ptr(submit->fixup_ptr),
   267					   job->fixup_count * sizeof(struct adla_fixup))) {
   268				ret = -EFAULT;
   269				goto err_free_fixups;
   270			}
   271		}
   272	
   273		ret = xa_alloc(&adla->pending_jobs, &id, job, xa_limit_32b, GFP_KERNEL);
   274		if (ret) {
   275			dev_err(adla->drm.dev, "xa_alloc failed: %d\n", ret);
   276			goto err_free_fixups;
   277		}
   278	
   279		job->id = id;
   280	
   281		ret = drm_sched_job_init(&job->base, &afile->entity, 1, filp,
   282					 filp->client_id);
   283		if (ret) {
   284			dev_err(adla->drm.dev, "drm_sched_job_init failed: %d\n", ret);
   285			goto err_xa_erase;
   286		}
   287	
   288		drm_sched_job_arm(&job->base);
   289		job->done_fence = dma_fence_get(&job->base.s_fence->finished);
   290		xa_store(&adla->pending_jobs, id, job->done_fence, GFP_KERNEL);
   291		drm_sched_entity_push_job(&job->base);
   292	
   293		submit->out_job_id = id;
   294	
   295		return 0;
   296	
   297	err_xa_erase:
   298		xa_erase(&adla->pending_jobs, id);
   299	err_free_fixups:
   300		kfree(job->fixups);
   301	err_free_config:
   302		kfree(job->config);
   303	err_free_job:
   304		kfree(job);
   305		return ret;
   306	}
   307	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki