[bug report] drm/msm: devcoredump iommu fault support

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Rob Clark,

The patch e25e92e08e32: "drm/msm: devcoredump iommu fault support"
from Jun 10, 2021, leads to the following Smatch static checker
warning:

drivers/gpu/drm/msm/msm_gpu.c:418 recover_worker() error: dereferencing freed memory 'gpu'
drivers/gpu/drm/msm/msm_gpu.c:497 fault_worker() error: dereferencing freed memory 'gpu'

drivers/gpu/drm/msm/msm_gpu.c
    376 static void recover_worker(struct kthread_work *work)
    377 {
    378         struct msm_gpu *gpu = container_of(work, struct msm_gpu, recover_work);
    379         struct drm_device *dev = gpu->dev;
    380         struct msm_drm_private *priv = dev->dev_private;
    381         struct msm_gem_submit *submit;
    382         struct msm_ringbuffer *cur_ring = gpu->funcs->active_ring(gpu);
    383         char *comm = NULL, *cmd = NULL;
    384         int i;
    385 
    386         mutex_lock(&gpu->lock);
    387 
    388         DRM_DEV_ERROR(dev->dev, "%s: hangcheck recover!\n", gpu->name);
    389 
    390         submit = find_submit(cur_ring, cur_ring->memptrs->fence + 1);
    391         if (submit) {
    392                 /* Increment the fault counts */
    393                 submit->queue->faults++;
    394                 submit->aspace->faults++;
    395 
    396                 get_comm_cmdline(submit, &comm, &cmd);
    397 
    398                 if (comm && cmd) {
    399                         DRM_DEV_ERROR(dev->dev, "%s: offending task: %s (%s)\n",
    400                                 gpu->name, comm, cmd);
    401 
    402                         msm_rd_dump_submit(priv->hangrd, submit,
    403                                 "offending task: %s (%s)", comm, cmd);
    404                 } else {
    405                         msm_rd_dump_submit(priv->hangrd, submit, NULL);
    406                 }
    407         } else {
    408                 /*
    409                  * We couldn't attribute this fault to any particular context,
    410                  * so increment the global fault count instead.
    411                  */
    412                 gpu->global_faults++;
    413         }
    414 
    415         /* Record the crash state */
    416         pm_runtime_get_sync(&gpu->pdev->dev);
    417         msm_gpu_crashstate_capture(gpu, submit, comm, cmd);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^
This function calls:

	dev_coredumpm(gpu->dev->dev, THIS_MODULE, gpu, 0, GFP_KERNEL,
                                                  ^^^
Which kfrees gpu.

--> 418         pm_runtime_put_sync(&gpu->pdev->dev);
                                     ^^^^^
The gpu wasn't supposed to be free so a lot of things go wrong from
this point.

    419 
    420         kfree(cmd);
    421         kfree(comm);
    422 
    423         /*
    424          * Update all the rings with the latest and greatest fence.. this
    425          * needs to happen after msm_rd_dump_submit() to ensure that the
    426          * bo's referenced by the offending submit are still around.
    427          */

regards,
dan carpenter