[bug report] drm/panfrost: Add sanity checks to submit IOCTL

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Tomeu Vizoso,

The patch 6ff408e6dc20: "drm/panfrost: Add sanity checks to submit
IOCTL" from Apr 24, 2019, leads to the following static checker
warning:

	drivers/gpu/drm/panfrost/panfrost_drv.c:222 panfrost_ioctl_submit()
	error: we previously assumed 'sync_out' could be null (see line 216)

drivers/gpu/drm/panfrost/panfrost_drv.c
   168  static int panfrost_ioctl_submit(struct drm_device *dev, void *data,
   169                  struct drm_file *file)
   170  {
   171          struct panfrost_device *pfdev = dev->dev_private;
   172          struct drm_panfrost_submit *args = data;
   173          struct drm_syncobj *sync_out = NULL;
   174          struct panfrost_job *job;
   175          int ret = 0;
   176  
   177          if (!args->jc)
   178                  return -EINVAL;
   179  
   180          if (args->requirements && args->requirements != PANFROST_JD_REQ_FS)
   181                  return -EINVAL;
   182  
   183          if (args->out_sync > 0) {
   184                  sync_out = drm_syncobj_find(file, args->out_sync);
   185                  if (!sync_out)
   186                          return -ENODEV;
   187          }
   188  
   189          job = kzalloc(sizeof(*job), GFP_KERNEL);
   190          if (!job) {
   191                  ret = -ENOMEM;
   192                  goto fail_out_sync;
   193          }
   194  
   195          kref_init(&job->refcount);
   196  
   197          job->pfdev = pfdev;
   198          job->jc = args->jc;
   199          job->requirements = args->requirements;
   200          job->flush_id = panfrost_gpu_get_latest_flush_id(pfdev);
   201          job->file_priv = file->driver_priv;
   202  
   203          ret = panfrost_copy_in_sync(dev, file, args, job);
   204          if (ret)
   205                  goto fail_job;
   206  
   207          ret = panfrost_lookup_bos(dev, file, args, job);
   208          if (ret)
   209                  goto fail_job;
   210  
   211		ret = panfrost_job_push(job);
   212          if (ret)
   213                  goto fail_job;
   214  
   215          /* Update the return sync object for the job */
   216          if (sync_out)
                    ^^^^^^^^
I'm pretty sure this can be removed.


   217                  drm_syncobj_replace_fence(sync_out, job->render_done_fence);
   218  
   219  fail_job:
   220          panfrost_job_put(job);
   221  fail_out_sync:
   222          drm_syncobj_put(sync_out);
                                ^^^^^^^^
Otherwise we are toasted...

   223  
   224          return ret;
   225  }

regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel