[bug report] drm/atomic: Pass the full state to planes async atomic check and update

[bug report] drm/atomic: Pass the full state to planes async atomic check and update

[Dan Carpenter]

Hello Maxime Ripard,

This is a semi-automatic email about new static checker warnings.

The patch 5ddb0bd4ddc3: "drm/atomic: Pass the full state to planes
async atomic check and update" from Feb 19, 2021, leads to the
following Smatch complaint:

    drivers/gpu/drm/mediatek/mtk_drm_plane.c:125 mtk_plane_atomic_async_check()
    warn: variable dereferenced before check 'state' (see line 106)

drivers/gpu/drm/mediatek/mtk_drm_plane.c
   103  static int mtk_plane_atomic_async_check(struct drm_plane *plane,
   104                                          struct drm_atomic_state *state)
   105  {
   106          struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
                                                                                         ^^^^^
The patch adds an unchecked dereference

   107                                                                                   plane);
   108          struct drm_crtc_state *crtc_state;
   109          int ret;
   110  
   111          if (plane != new_plane_state->crtc->cursor)
   112                  return -EINVAL;
   113  
   114          if (!plane->state)
   115                  return -EINVAL;
   116  
   117          if (!plane->state->fb)
   118                  return -EINVAL;
   119  
   120          ret = mtk_drm_crtc_plane_check(new_plane_state->crtc, plane,
   121                                         to_mtk_plane_state(new_plane_state));
   122          if (ret)
   123                  return ret;
   124  
   125          if (state)
                    ^^^^^
But the existing code has a check for NULL and comments explaining when
state can be NULL.

   126                  crtc_state = drm_atomic_get_existing_crtc_state(state,
   127                                                                  new_plane_state->crtc);
   128          else /* Special case for asynchronous cursor updates. */
   129                  crtc_state = new_plane_state->crtc->state;
   130  
   131          return drm_atomic_helper_check_plane_state(plane->state, crtc_state,
   132                                                     DRM_PLANE_NO_SCALING,
   133                                                     DRM_PLANE_NO_SCALING,
   134                                                     true, true);
   135  }

regards,
dan carpenter