From: Dan Carpenter <dan.carpenter@linaro.org>
To: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org
Subject: [bug report] drm/nouveau/disp/r535: initial support
Date: Mon, 15 Apr 2024 17:41:39 +0300 [thread overview]
Message-ID: <e936004c-95d7-4326-93b6-e447f743e9f4@moroto.mountain> (raw)
Hello Nouveau Devs,
Commit 9e9944449023 ("drm/nouveau/disp/r535: initial support") from
Sep 19, 2023 (linux-next), leads to the following Smatch static
checker warning:
drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c:1482 r535_disp_oneinit() error: potential NULL/IS_ERR bug 'ctrl'
drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c:1582 r535_disp_oneinit() error: potential NULL/IS_ERR bug 'ctrl'
drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c:1596 r535_disp_oneinit() error: potential NULL/IS_ERR bug 'ctrl'
drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c:1625 r535_disp_oneinit() error: potential NULL/IS_ERR bug 'ctrl'
drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c:519 r535_fifo_ectx_size() error: potential NULL/IS_ERR bug 'ctrl'
drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c:556 r535_fifo_runl_ctor() error: potential NULL/IS_ERR bug 'ctrl'
drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c:631 r535_fifo_runl_ctor() error: potential NULL/IS_ERR bug 'ctrl'
drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c
1432 static int
1433 r535_disp_oneinit(struct nvkm_disp *disp)
1434 {
1435 struct nvkm_device *device = disp->engine.subdev.device;
1436 struct nvkm_gsp *gsp = device->gsp;
1437 NV2080_CTRL_INTERNAL_DISPLAY_WRITE_INST_MEM_PARAMS *ctrl;
1438 int ret, i;
1439
1440 /* RAMIN. */
1441 ret = nvkm_gpuobj_new(device, 0x10000, 0x10000, false, NULL, &disp->inst);
1442 if (ret)
1443 return ret;
1444
1445 if (WARN_ON(nvkm_memory_target(disp->inst->memory) != NVKM_MEM_TARGET_VRAM))
1446 return -EINVAL;
1447
1448 ctrl = nvkm_gsp_rm_ctrl_get(&gsp->internal.device.subdevice,
1449 NV2080_CTRL_CMD_INTERNAL_DISPLAY_WRITE_INST_MEM,
1450 sizeof(*ctrl));
1451 if (IS_ERR(ctrl))
1452 return PTR_ERR(ctrl);
1453
1454 ctrl->instMemPhysAddr = nvkm_memory_addr(disp->inst->memory);
1455 ctrl->instMemSize = nvkm_memory_size(disp->inst->memory);
1456 ctrl->instMemAddrSpace = ADDR_FBMEM;
1457 ctrl->instMemCpuCacheAttr = NV_MEMORY_WRITECOMBINED;
1458
1459 ret = nvkm_gsp_rm_ctrl_wr(&gsp->internal.device.subdevice, ctrl);
1460 if (ret)
1461 return ret;
1462
1463 /* OBJs. */
1464 ret = nvkm_gsp_client_device_ctor(gsp, &disp->rm.client, &disp->rm.device);
1465 if (ret)
1466 return ret;
1467
1468 ret = nvkm_gsp_rm_alloc(&disp->rm.device.object, 0x00730000, NV04_DISPLAY_COMMON, 0,
1469 &disp->rm.objcom);
1470 if (ret)
1471 return ret;
1472
1473 {
1474 NV2080_CTRL_INTERNAL_DISPLAY_GET_STATIC_INFO_PARAMS *ctrl;
1475
1476 ctrl = nvkm_gsp_rm_ctrl_rd(&gsp->internal.device.subdevice,
1477 NV2080_CTRL_CMD_INTERNAL_DISPLAY_GET_STATIC_INFO,
1478 sizeof(*ctrl));
1479 if (IS_ERR(ctrl))
The problem here is that r535_gsp_rpc_push() returns a mix of error
pointers and NULL. I've written a blog about how mixing error pointers
and NULL normally works and I think there is some kind of similar logic
here but I forget what it is...
https://staticthinking.wordpress.com/2022/08/01/mixing-error-pointers-and-null/
1480 return PTR_ERR(ctrl);
1481
--> 1482 disp->wndw.mask = ctrl->windowPresentMask;
^^^^^^
Potential NULL dereference.
1483 disp->wndw.nr = fls(disp->wndw.mask);
1484 nvkm_gsp_rm_ctrl_done(&gsp->internal.device.subdevice, ctrl);
1485 }
1486
1487 /* */
1488 {
1489 #if defined(CONFIG_ACPI) && defined(CONFIG_X86)
1490 NV2080_CTRL_INTERNAL_INIT_BRIGHTC_STATE_LOAD_PARAMS *ctrl;
1491 struct nvkm_gsp_object *subdevice = &disp->rm.client.gsp->internal.device.subdevice;
1492
1493 ctrl = nvkm_gsp_rm_ctrl_get(subdevice,
1494 NV2080_CTRL_CMD_INTERNAL_INIT_BRIGHTC_STATE_LOAD,
1495 sizeof(*ctrl));
1496 if (IS_ERR(ctrl))
regards,
dan carpenter
reply other threads:[~2024-04-15 14:41 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e936004c-95d7-4326-93b6-e447f743e9f4@moroto.mountain \
--to=dan.carpenter@linaro.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=nouveau@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.