Re: [PATCH v8 10/39] drm/fb-dma-helper: Handle framebuffers without a GEM object

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] drm/fb-dma-helper: drm_WARN_ON_ONCE() in
  drm_fb_dma_get_scanout_buffer()
--

commit 42874beaaaa70520e8f9990fa06a12e91732fab6
Author: Maxime Ripard <mripard@kernel.org>

drm/fb-dma-helper: Handle framebuffers without a GEM object

This commit updates drm_fb_dma_get_scanout_buffer() to return -ENODEV when
a framebuffer has no backing GEM object on its first plane, such as a
framebuffer reconstructed from hardware state readout.

> diff --git a/drivers/gpu/drm/drm_fb_dma_helper.c b/drivers/gpu/drm/drm_fb_dma_helper.c
> index fd71969d2fb15..3a37253ab9f83 100644
> --- a/drivers/gpu/drm/drm_fb_dma_helper.c
> +++ b/drivers/gpu/drm/drm_fb_dma_helper.c
> @@ -179,6 +179,14 @@ int drm_fb_dma_get_scanout_buffer(struct drm_plane *plane,
>  
>  	dma_obj = drm_fb_dma_get_gem_obj(fb, 0);
>  
> +	/*
> +	 * The framebuffer has no GEM object backing its first plane,
> +	 * like a framebuffer reconstructed from a hardware state
> +	 * readout: we cannot access its contents.
> +	 */
> +	if (!dma_obj)
> +		return -ENODEV;
> +
>  	/* Buffer should be accessible from the CPU */
>  	if (drm_gem_is_imported(&dma_obj->base))
>  		return -ENODEV;

[Severity: Medium]
Does calling drm_fb_dma_get_gem_obj(fb, 0) here trigger a drm_WARN_ON_ONCE()
when fb->obj[0] is NULL?

drm_fb_dma_get_gem_obj() calls drm_gem_fb_get_obj(), which warns when a
plane has no backing GEM object:

drivers/gpu/drm/drm_gem_framebuffer_helper.c:drm_gem_fb_get_obj() {
	...
	if (drm_WARN_ON_ONCE(dev, plane >= ARRAY_SIZE(fb->obj)))
		return NULL;
	else if (drm_WARN_ON_ONCE(dev, !fb->obj[plane]))
		return NULL;
	...
}

When a panic occurs while a hardware readout framebuffer is still active,
drm_fb_dma_get_scanout_buffer() will hit that warning (or a nested panic if
panic_on_warn is set).

Note that the following patch in the series, commit "drm/gem-atomic-helper:
Handle framebuffers without a GEM object", checks state->fb->obj[i] directly
in drm_gem_plane_helper_prepare_fb() to avoid this same warning. Checking
!fb->obj[0] before calling drm_fb_dma_get_gem_obj(fb, 0) would avoid it here
as well.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106-drm-state-readout-v8-0-cbe78624e1bc@kernel.org?part=10