[bug report] drm/panfrost: Add sanity checks to submit IOCTL

[bug report] drm/panfrost: Add sanity checks to submit IOCTL

[Dan Carpenter]

Hello Tomeu Vizoso,

The patch 6ff408e6dc20: "drm/panfrost: Add sanity checks to submit
IOCTL" from Apr 24, 2019, leads to the following static checker
warning:

	drivers/gpu/drm/panfrost/panfrost_drv.c:222 panfrost_ioctl_submit()
	error: we previously assumed 'sync_out' could be null (see line 216)

drivers/gpu/drm/panfrost/panfrost_drv.c
   168  static int panfrost_ioctl_submit(struct drm_device *dev, void *data,
   169                  struct drm_file *file)
   170  {
   171          struct panfrost_device *pfdev = dev->dev_private;
   172          struct drm_panfrost_submit *args = data;
   173          struct drm_syncobj *sync_out = NULL;
   174          struct panfrost_job *job;
   175          int ret = 0;
   176  
   177          if (!args->jc)
   178                  return -EINVAL;
   179  
   180          if (args->requirements && args->requirements != PANFROST_JD_REQ_FS)
   181                  return -EINVAL;
   182  
   183          if (args->out_sync > 0) {
   184                  sync_out = drm_syncobj_find(file, args->out_sync);
   185                  if (!sync_out)
   186                          return -ENODEV;
   187          }
   188  
   189          job = kzalloc(sizeof(*job), GFP_KERNEL);
   190          if (!job) {
   191                  ret = -ENOMEM;
   192                  goto fail_out_sync;
   193          }
   194  
   195          kref_init(&job->refcount);
   196  
   197          job->pfdev = pfdev;
   198          job->jc = args->jc;
   199          job->requirements = args->requirements;
   200          job->flush_id = panfrost_gpu_get_latest_flush_id(pfdev);
   201          job->file_priv = file->driver_priv;
   202  
   203          ret = panfrost_copy_in_sync(dev, file, args, job);
   204          if (ret)
   205                  goto fail_job;
   206  
   207          ret = panfrost_lookup_bos(dev, file, args, job);
   208          if (ret)
   209                  goto fail_job;
   210  
   211		ret = panfrost_job_push(job);
   212          if (ret)
   213                  goto fail_job;
   214  
   215          /* Update the return sync object for the job */
   216          if (sync_out)
                    ^^^^^^^^
I'm pretty sure this can be removed.


   217                  drm_syncobj_replace_fence(sync_out, job->render_done_fence);
   218  
   219  fail_job:
   220          panfrost_job_put(job);
   221  fail_out_sync:
   222          drm_syncobj_put(sync_out);
                                ^^^^^^^^
Otherwise we are toasted...

   223  
   224          return ret;
   225  }

regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH] drm/panfrost: Only put sync_out if non-NULL

[Tomeu Vizoso]

Dan Carpenter's static analysis tool reported:

drivers/gpu/drm/panfrost/panfrost_drv.c:222 panfrost_ioctl_submit()
error: we previously assumed 'sync_out' could be null (see line 216)

Indeed, sync_out could be NULL if userspace doesn't send a sync object
ID for the out fence.

Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lists.freedesktop.org/archives/dri-devel/2019-May/217014.html
---
 drivers/gpu/drm/panfrost/panfrost_drv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c
index 94b0819ad50b..d11e2281dde6 100644
--- a/drivers/gpu/drm/panfrost/panfrost_drv.c
+++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
@@ -219,7 +219,8 @@ static int panfrost_ioctl_submit(struct drm_device *dev, void *data,
 fail_job:
 	panfrost_job_put(job);
 fail_out_sync:
-	drm_syncobj_put(sync_out);
+	if (sync_out)
+		drm_syncobj_put(sync_out);
 
 	return ret;
 }
-- 
2.20.1

Re: [PATCH] drm/panfrost: Only put sync_out if non-NULL

[Steven Price]

On 09/05/2019 09:21, Tomeu Vizoso wrote:
> Dan Carpenter's static analysis tool reported:
> 
> drivers/gpu/drm/panfrost/panfrost_drv.c:222 panfrost_ioctl_submit()
> error: we previously assumed 'sync_out' could be null (see line 216)
> 
> Indeed, sync_out could be NULL if userspace doesn't send a sync object
> ID for the out fence.
> 
> Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Link: https://lists.freedesktop.org/archives/dri-devel/2019-May/217014.html

Reviewed-by: Steven Price <steven.price@arm.com>

> ---
>  drivers/gpu/drm/panfrost/panfrost_drv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c
> index 94b0819ad50b..d11e2281dde6 100644
> --- a/drivers/gpu/drm/panfrost/panfrost_drv.c
> +++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
> @@ -219,7 +219,8 @@ static int panfrost_ioctl_submit(struct drm_device *dev, void *data,
>  fail_job:
>  	panfrost_job_put(job);
>  fail_out_sync:
> -	drm_syncobj_put(sync_out);
> +	if (sync_out)
> +		drm_syncobj_put(sync_out);
>  
>  	return ret;
>  }
> 

Re: [PATCH] drm/panfrost: Only put sync_out if non-NULL

[Rob Herring]

On Thu, May 9, 2019 at 3:22 AM Tomeu Vizoso <tomeu.vizoso@collabora.com> wrote:
>
> Dan Carpenter's static analysis tool reported:
>
> drivers/gpu/drm/panfrost/panfrost_drv.c:222 panfrost_ioctl_submit()
> error: we previously assumed 'sync_out' could be null (see line 216)
>
> Indeed, sync_out could be NULL if userspace doesn't send a sync object
> ID for the out fence.
>
> Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Link: https://lists.freedesktop.org/archives/dri-devel/2019-May/217014.html
> ---
>  drivers/gpu/drm/panfrost/panfrost_drv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Applied.

Rob