linux-kernel - drivers/gpu/drm/rockchip/rockchip_drm_vop.c:1046 vop_plane_atomic_async_check() warn: variable dereferenced before check 'state' (see line 1027)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 14 Sep 2021 12:54:16 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Maxime Ripard <maxime@...no.tech>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org
Subject: drivers/gpu/drm/rockchip/rockchip_drm_vop.c:1046
 vop_plane_atomic_async_check() warn: variable dereferenced before check
 'state' (see line 1027)

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   78e709522d2c012cb0daad2e668506637bffb7c2
commit: 5ddb0bd4ddc35d9c9376d109398f84277bb8d25e drm/atomic: Pass the full state to planes async atomic check and update
config: riscv-randconfig-m031-20210912 (attached as .config)
compiler: riscv32-linux-gcc (GCC) 11.2.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
drivers/gpu/drm/rockchip/rockchip_drm_vop.c:1046 vop_plane_atomic_async_check() warn: variable dereferenced before check 'state' (see line 1027)

vim +/state +1046 drivers/gpu/drm/rockchip/rockchip_drm_vop.c

15609559a834a5 Enric Balletbo i Serra 2018-12-05  1024  static int vop_plane_atomic_async_check(struct drm_plane *plane,
5ddb0bd4ddc35d Maxime Ripard          2021-02-19  1025  					struct drm_atomic_state *state)
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1026  {
5ddb0bd4ddc35d Maxime Ripard          2021-02-19 @1027  	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
                                                                                                                                         ^^^^^
Dereferenced inside the function.

5ddb0bd4ddc35d Maxime Ripard          2021-02-19  1028  										 plane);
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1029  	struct vop_win *vop_win = to_vop_win(plane);
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1030  	const struct vop_win_data *win = vop_win->data;
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1031  	int min_scale = win->phy->scl ? FRAC_16_16(1, 8) :
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1032  					DRM_PLANE_HELPER_NO_SCALING;
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1033  	int max_scale = win->phy->scl ? FRAC_16_16(8, 1) :
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1034  					DRM_PLANE_HELPER_NO_SCALING;
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1035  	struct drm_crtc_state *crtc_state;
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1036  
5ddb0bd4ddc35d Maxime Ripard          2021-02-19  1037  	if (plane != new_plane_state->crtc->cursor)
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1038  		return -EINVAL;
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1039  
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1040  	if (!plane->state)
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1041  		return -EINVAL;
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1042  
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1043  	if (!plane->state->fb)
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1044  		return -EINVAL;
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1045  
5ddb0bd4ddc35d Maxime Ripard          2021-02-19 @1046  	if (state)
                                                                    ^^^^^
Checked for NULL.  Too late!

5ddb0bd4ddc35d Maxime Ripard          2021-02-19  1047  		crtc_state = drm_atomic_get_existing_crtc_state(state,
5ddb0bd4ddc35d Maxime Ripard          2021-02-19  1048  								new_plane_state->crtc);
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1049  	else /* Special case for asynchronous cursor updates. */
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1050  		crtc_state = plane->crtc->state;
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1051  
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1052  	return drm_atomic_helper_check_plane_state(plane->state, crtc_state,
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1053  						   min_scale, max_scale,
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1054  						   true, true);
15609559a834a5 Enric Balletbo i Serra 2018-12-05  1055  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org