linux-kernel - Re: [PATCH] drm/loongson: Remove a useless check in cursor_plane_atomic_async

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6c7bbce7-5521-b868-019f-bce26f309730@suse.de>
Date:   Mon, 10 Jul 2023 12:39:21 +0200
From:   Thomas Zimmermann <tzimmermann@...e.de>
To:     Sui Jingfeng <suijingfeng@...ngson.cn>,
        David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>, Li Yi <liyi@...ngson.cn>
Cc:     dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        loongson-kernel@...ts.loongnix.cn,
        Dan Carpenter <dan.carpenter@...aro.org>
Subject: Re: [PATCH] drm/loongson: Remove a useless check in
 cursor_plane_atomic_async_check()



Am 10.07.23 um 12:24 schrieb Sui Jingfeng:
> Because smatch warnings:
> 
> drivers/gpu/drm/loongson/lsdc_plane.c:199
> lsdc_cursor_plane_atomic_async_check()
> warn: variable dereferenced before check 'state' (see line 180)
> 
> vim +/state +199 drivers/gpu/drm/loongson/lsdc_plane.c
> 
> 174  static int
>       lsdc_cursor_plane_atomic_async_check(struct drm_plane *plane,
> 175                                       struct drm_atomic_state *state)
> 176  {
> 177          struct drm_plane_state *new_state;
> 178          struct drm_crtc_state *crtc_state;
> 179
> 180          new_state = drm_atomic_get_new_plane_state(state, plane);
>                                                          ^^^^^
> state is dereferenced inside this function
> 
> 181
> 182  if (!plane->state || !plane->state->fb) {
> 183          drm_dbg(plane->dev, "%s: state is NULL\n", plane->name);
> 184                  return -EINVAL;
> 185  }
> 186
> 187  if (new_state->crtc_w != new_state->crtc_h) {
> 188          drm_dbg(plane->dev, "unsupported cursor size: %ux%u\n",
> 189                  new_state->crtc_w, new_state->crtc_h);
> 190          return -EINVAL;
> 191  }
> 192
> 193  if (new_state->crtc_w != 64 && new_state->crtc_w != 32) {
> 194          drm_dbg(plane->dev, "unsupported cursor size: %ux%u\n",
> 195                  new_state->crtc_w, new_state->crtc_h);
> 196          return -EINVAL;
> 197  }
> 198
> 199  if (state) {
>           ^^^^^
> Checked too late!
> 
> Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
> Closes: https://lore.kernel.org/r/202307100423.rV7D05Uq-lkp@intel.com/
> Signed-off-by: Sui Jingfeng <suijingfeng@...ngson.cn>

Acked-by: Thomas Zimmermann <tzimmermann@...e.de>

BTW, you're posting these patches for loongson, but that driver is not 
yet in our tree?

Best regards
Thomas


> ---
>   drivers/gpu/drm/loongson/lsdc_plane.c | 8 +-------
>   1 file changed, 1 insertion(+), 7 deletions(-)
> 
> diff --git a/drivers/gpu/drm/loongson/lsdc_plane.c b/drivers/gpu/drm/loongson/lsdc_plane.c
> index 2ab3db982aa3..0d5094633222 100644
> --- a/drivers/gpu/drm/loongson/lsdc_plane.c
> +++ b/drivers/gpu/drm/loongson/lsdc_plane.c
> @@ -196,13 +196,7 @@ static int lsdc_cursor_plane_atomic_async_check(struct drm_plane *plane,
>   		return -EINVAL;
>   	}
>   
> -	if (state) {
> -		crtc_state = drm_atomic_get_existing_crtc_state(state, new_state->crtc);
> -	} else {
> -		crtc_state = plane->crtc->state;
> -		drm_dbg(plane->dev, "%s: atomic state is NULL\n", plane->name);
> -	}
> -
> +	crtc_state = drm_atomic_get_existing_crtc_state(state, new_state->crtc);
>   	if (!crtc_state->active)
>   		return -EINVAL;
>   

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)