[Bug 188631] New: Function vc4_cl_lookup_bos() does not set error code when the call to drm_malloc_ab() fails

[bugzilla-daemon at bugzilla.kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=188631

            Bug ID: 188631
           Summary: Function vc4_cl_lookup_bos() does not set error code
                    when the call to drm_malloc_ab() fails
           Product: Drivers
           Version: 2.5
    Kernel Version: linux-4.9-rc6
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: Video(DRI - non Intel)
          Assignee: drivers_video-dri at kernel-bugs.osdl.org
          Reporter: bianpan2010 at ruc.edu.cn
        Regression: No

Function drm_malloc_ab() returns a NULL pointer if there is no enough memory.
In function vc4_cl_lookup_bos() defined in file file
drivers/gpu/drm/vc4/vc4_gem.c, varaible ret takes the return error code. When
the call to drm_malloc_ab() (at line 545) fails, however, ret is not set to a
negative integer, and as a result, 0 will be returned. 0 indicates that there
is no error, which is contrary to the fact. Maybe it is better to assign
"-ENOMEM" to ret when the check of the return value of drm_malloc_ab() fails.
Codes related to this bug are summarised as follows.

vc4_cl_lookup_bos @@ drivers/gpu/drm/vc4/vc4_gem.c
518 static int
519 vc4_cl_lookup_bos(struct drm_device *dev,
520           struct drm_file *file_priv,
521           struct vc4_exec_info *exec)
522 {
523     struct drm_vc4_submit_cl *args = exec->args;
524     uint32_t *handles;
525     int ret = 0;
        ...
538     exec->bo = drm_calloc_large(exec->bo_count,
539                     sizeof(struct drm_gem_cma_object *));
540     if (!exec->bo) {
541         DRM_ERROR("Failed to allocate validated BO pointers\n");
542         return -ENOMEM;
543     }
544 
545     handles = drm_malloc_ab(exec->bo_count, sizeof(uint32_t));
546     if (!handles) {
547         DRM_ERROR("Failed to allocate incoming GEM handles\n");
548         goto fail;       // insert "ret = -ENOMEM;" before this jump
instruction?
549     }
        ...
575 fail:
576     drm_free_large(handles);
577     return ret;
578 }

Thanks very much!

-- 
You are receiving this mail because:
You are watching the assignee of the bug.