| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <36935440-aa60-469e-876c-f0a0cb7074c5@stanley.mountain>
Date: Wed, 2 Apr 2025 14:18:36 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: oe-kbuild@...ts.linux.dev, Jessica Zhang <quic_jesszhan@...cinc.com>
Cc: lkp@...el.com, oe-kbuild-all@...ts.linux.dev,
linux-kernel@...r.kernel.org,
Dmitry Baryshkov <dmitry.baryshkov@...aro.org>,
Abhinav Kumar <quic_abhinavk@...cinc.com>
Subject: drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c:1672
_dpu_encoder_trigger_start() warn: variable dereferenced before check 'phys'
(see line 1670)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: acc4d5ff0b61eb1715c498b6536c38c1feb7f3c1
commit: 8144d17a81d9ea742be5a02da62f5a7b2a8f95c1 drm/msm/dpu: Skip trigger flush and start for CWB
date: 4 weeks ago
config: arm64-randconfig-r073-20250402 (https://download.01.org/0day-ci/archive/20250402/202504021825.IW2340OS-lkp@intel.com/config)
compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
| Closes: https://lore.kernel.org/r/202504021825.IW2340OS-lkp@intel.com/
smatch warnings:
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c:1672 _dpu_encoder_trigger_start() warn: variable dereferenced before check 'phys' (see line 1670)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c:1814 _dpu_encoder_kickoff_phys() error: we previously assumed 'dpu_enc->cur_master' could be null (see line 1807)
vim +/phys +1672 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
58fba464eaeff6 Sean Paul 2018-09-20 1668 static void _dpu_encoder_trigger_start(struct dpu_encoder_phys *phys)
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1669 {
8144d17a81d9ea Jessica Zhang 2025-02-14 @1670 struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(phys->parent);
^^^^^^^^^^^^
Dereference
8144d17a81d9ea Jessica Zhang 2025-02-14 1671
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 @1672 if (!phys) {
^^^^^
Checked too late.
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1673 DPU_ERROR("invalid argument(s)\n");
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1674 return;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1675 }
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1676
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1677 if (!phys->hw_pp) {
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1678 DPU_ERROR("invalid pingpong hw\n");
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1679 return;
[ snip ]
b4bb9f15b44392 Rob Clark 2019-08-29 1771 static void _dpu_encoder_kickoff_phys(struct dpu_encoder_virt *dpu_enc)
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1772 {
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1773 struct dpu_hw_ctl *ctl;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1774 uint32_t i, pending_flush;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1775 unsigned long lock_flags;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1776
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1777 pending_flush = 0x0;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1778
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1779 /* update pending counts and trigger kickoff ctl flush atomically */
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1780 spin_lock_irqsave(&dpu_enc->enc_spinlock, lock_flags);
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1781
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1782 /* don't perform flush/start operations for slave encoders */
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1783 for (i = 0; i < dpu_enc->num_phys_encs; i++) {
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1784 struct dpu_encoder_phys *phys = dpu_enc->phys_encs[i];
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1785
b6fadcade62704 Drew Davenport 2019-12-06 1786 if (phys->enable_state == DPU_ENC_DISABLED)
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1787 continue;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1788
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1789 ctl = phys->hw_ctl;
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1790
f98baa3109cea4 Sean Paul 2019-01-30 1791 /*
f98baa3109cea4 Sean Paul 2019-01-30 1792 * This is cleared in frame_done worker, which isn't invoked
f98baa3109cea4 Sean Paul 2019-01-30 1793 * for async commits. So don't set this for async, since it'll
f98baa3109cea4 Sean Paul 2019-01-30 1794 * roll over to the next commit.
f98baa3109cea4 Sean Paul 2019-01-30 1795 */
b4bb9f15b44392 Rob Clark 2019-08-29 1796 if (phys->split_role != ENC_ROLE_SLAVE)
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1797 set_bit(i, dpu_enc->frame_busy_mask);
f98baa3109cea4 Sean Paul 2019-01-30 1798
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1799 if (!phys->ops.needs_single_flush ||
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1800 !phys->ops.needs_single_flush(phys))
b4bb9f15b44392 Rob Clark 2019-08-29 1801 _dpu_encoder_trigger_flush(&dpu_enc->base, phys, 0x0);
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1802 else if (ctl->ops.get_pending_flush)
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1803 pending_flush |= ctl->ops.get_pending_flush(ctl);
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1804 }
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1805
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1806 /* for split flush, combine pending flush masks and send to master */
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 @1807 if (pending_flush && dpu_enc->cur_master) {
^^^^^^^^^^^^^^^^^^^
Check for NULL
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1808 _dpu_encoder_trigger_flush(
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1809 &dpu_enc->base,
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1810 dpu_enc->cur_master,
b4bb9f15b44392 Rob Clark 2019-08-29 1811 pending_flush);
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1812 }
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1813
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 @1814 _dpu_encoder_trigger_start(dpu_enc->cur_master);
^^^^^^^^^^^^^^^^^^^
Unchecked dereference
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1815
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1816 spin_unlock_irqrestore(&dpu_enc->enc_spinlock, lock_flags);
25fdd5933e4c0f Jeykumar Sankaran 2018-06-27 1817 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists