linux-kernel - drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1371 dpu_plane_reset() warn: variable dereferenced before check 'plane' (see line 1369)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 19 May 2023 19:28:04 +0300
From:   Dan Carpenter <dan.carpenter@...aro.org>
To:     oe-kbuild@...ts.linux.dev,
        Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
Cc:     lkp@...el.com, oe-kbuild-all@...ts.linux.dev,
        linux-kernel@...r.kernel.org,
        Abhinav Kumar <quic_abhinavk@...cinc.com>
Subject: drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1371 dpu_plane_reset()
 warn: variable dereferenced before check 'plane' (see line 1369)

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   2d1bcbc6cd703e64caf8df314e3669b4786e008a
commit: 7f38ec140d9c1f257eb55d45d224a7203998d3cc drm/msm/dpu: move pipe_hw to dpu_plane_state
config: ia64-randconfig-m041-20230514
compiler: ia64-linux-gcc (GCC) 12.1.0

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@...el.com>
| Reported-by: Dan Carpenter <error27@...il.com>
| Closes: https://lore.kernel.org/r/202305192230.fkMk4qjF-lkp@intel.com/

New smatch warnings:
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1371 dpu_plane_reset() warn: variable dereferenced before check 'plane' (see line 1369)

Old smatch warnings:
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:618 _dpu_plane_get_csc() warn: variable dereferenced before check 'pdpu' (see line 615)

vim +/plane +1371 drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c

25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1365  static void dpu_plane_reset(struct drm_plane *plane)
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1366  {
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1367  	struct dpu_plane *pdpu;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1368  	struct dpu_plane_state *pstate;
7f38ec140d9c1f Dmitry Baryshkov  2023-03-16 @1369  	struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
                                                                                                     ^^^^^
Dereference inside the function.

25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1370  
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 @1371  	if (!plane) {
                                                            ^^^^^^
Checked too late.

25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1372  		DPU_ERROR("invalid plane\n");
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1373  		return;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1374  	}
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1375  
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1376  	pdpu = to_dpu_plane(plane);
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1377  	DPU_DEBUG_PLANE(pdpu, "\n");
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1378  
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1379  	/* remove previous state, if present */
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1380  	if (plane->state) {
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1381  		dpu_plane_destroy_state(plane, plane->state);
c9ef97b694b9bf Bernard Zhao      2021-05-09  1382  		plane->state = NULL;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1383  	}
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1384  
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1385  	pstate = kzalloc(sizeof(*pstate), GFP_KERNEL);
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1386  	if (!pstate) {
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1387  		DPU_ERROR_PLANE(pdpu, "failed to allocate state\n");
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1388  		return;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1389  	}
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1390  
7f38ec140d9c1f Dmitry Baryshkov  2023-03-16  1391  	/*
7f38ec140d9c1f Dmitry Baryshkov  2023-03-16  1392  	 * Set the SSPP here until we have proper virtualized DPU planes.
7f38ec140d9c1f Dmitry Baryshkov  2023-03-16  1393  	 * This is the place where the state is allocated, so fill it fully.
7f38ec140d9c1f Dmitry Baryshkov  2023-03-16  1394  	 */
7f38ec140d9c1f Dmitry Baryshkov  2023-03-16  1395  	pstate->hw_sspp = dpu_rm_get_sspp(&dpu_kms->rm, pdpu->pipe);
7f38ec140d9c1f Dmitry Baryshkov  2023-03-16  1396  
f964cfb7bcffc8 Dmitry Baryshkov  2021-06-28  1397  	__drm_atomic_helper_plane_reset(plane, &pstate->base);
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27  1398  }

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki