Re: [PATCH RESEND 54/83] drm/tests: drm_atomic_state_test: Switch to drm_mode_config_create_initial_state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/tests: error pointer dereference in drm_atomic_commit_test callers
--

commit bf780a2e8e49270edd5c0a0b1f92ae2a80dbb4a2
Author: Maxime Ripard <mripard@kernel.org>

drm/tests: drm_atomic_state_test: Switch to drm_mode_config_create_initial_state

This commit replaces the call to drm_mode_config_reset() in
drm_atomic_test_init_drm_components() with
drm_mode_config_create_initial_state() to initialize KMS state for the atomic
commit KUnit tests.

> diff --git a/drivers/gpu/drm/tests/drm_atomic_commit_test.c b/drivers/gpu/drm/tests/drm_atomic_commit_test.c
> index 6ccb001f6264b..97f60ce68b3e4 100644
> --- a/drivers/gpu/drm/tests/drm_atomic_commit_test.c
> +++ b/drivers/gpu/drm/tests/drm_atomic_commit_test.c
> @@ -134,7 +134,9 @@ drm_atomic_test_init_drm_components(struct kunit *test, bool has_connectors)
>  	}
>  
>  done:
> -	drm_mode_config_reset(drm);
> +	ret = drm_mode_config_create_initial_state(drm);
> +	if (ret)
> +		return ERR_PTR(ret);
>  
>  	return priv;
>  }

[Severity: Medium]
Can returning ERR_PTR(ret) here lead to an error pointer dereference in the
callers of drm_atomic_test_init_drm_components()?

Both drm_test_check_connector_changed_modeset() and
drm_test_check_valid_clones() only check the returned pointer with
KUNIT_ASSERT_NOT_NULL():

	priv = drm_atomic_test_init_drm_components(test, true);
	KUNIT_ASSERT_NOT_NULL(test, priv);

If drm_mode_config_create_initial_state() returns a negative error code,
ERR_PTR(ret) will pass the KUNIT_ASSERT_NOT_NULL() check and be dereferenced
in set_up_atomic_state().

Every other failure check in drm_atomic_test_init_drm_components() uses
KUNIT_ASSERT_NOT_ERR_OR_NULL() or KUNIT_ASSERT_EQ(test, ret, 0) to abort the
test immediately. Should this check use KUNIT_ASSERT_EQ(test, ret, 0) as well,
or should the callers be updated to use KUNIT_ASSERT_NOT_ERR_OR_NULL()?

Also, this isn't a bug, but the commit subject prefix says
drm_atomic_state_test while the modified file is drm_atomic_commit_test.c.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105-drm-no-more-config-reset-v1-0-1f58d1e33380@kernel.org?part=54