On 32-bit architectures, 'unsigned long size' can never exceed UBLK_SHMEM_BUF_SIZE_MAX (1ULL << 32), causing a tautological comparison warning. Validate buf_reg.len (__u64) directly before using it, and consolidate all input validation into a single check. Also remove the unnecessary local variables 'addr' and 'size' since buf_reg.addr and buf_reg.len can be used directly. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604101952.3NOzqnu9-lkp@intel.com/ Fixes: 23b3b6f0b584 ("ublk: widen ublk_shmem_buf_reg.len to __u64 for 4GB buffer support") Signed-off-by: Ming Lei --- drivers/block/ublk_drv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 247c1ce8ce8a..49fb584e392b 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -5330,7 +5330,7 @@ static int ublk_ctrl_reg_buf(struct ublk_device *ub, { void __user *argp = (void __user *)(unsigned long)header->addr; struct ublk_shmem_buf_reg buf_reg; - unsigned long addr, size, nr_pages; + unsigned long nr_pages; struct page **pages = NULL; unsigned int gup_flags; unsigned int memflags; @@ -5352,14 +5352,12 @@ static int ublk_ctrl_reg_buf(struct ublk_device *ub, if (buf_reg.reserved) return -EINVAL; - addr = buf_reg.addr; - size = buf_reg.len; - nr_pages = size >> PAGE_SHIFT; - - if (!size || size > UBLK_SHMEM_BUF_SIZE_MAX || - !PAGE_ALIGNED(size) || !PAGE_ALIGNED(addr)) + if (!buf_reg.len || buf_reg.len > UBLK_SHMEM_BUF_SIZE_MAX || + !PAGE_ALIGNED(buf_reg.len) || !PAGE_ALIGNED(buf_reg.addr)) return -EINVAL; + nr_pages = buf_reg.len >> PAGE_SHIFT; + /* Pin pages before any locks (may sleep) */ pages = kvmalloc_array(nr_pages, sizeof(*pages), GFP_KERNEL); if (!pages) @@ -5369,7 +5367,7 @@ static int ublk_ctrl_reg_buf(struct ublk_device *ub, if (!(buf_reg.flags & UBLK_SHMEM_BUF_READ_ONLY)) gup_flags |= FOLL_WRITE; - pinned = pin_user_pages_fast(addr, nr_pages, gup_flags, pages); + pinned = pin_user_pages_fast(buf_reg.addr, nr_pages, gup_flags, pages); if (pinned < 0) { ret = pinned; goto err_free_pages; -- 2.53.0