[Intel-gfx] [bug report] drm/i915: Preallocate our mmu notifier workequeu to unbreak cpu hotplug deadlock

[Dan Carpenter]

Hello Daniel Vetter,

The patch 7741b547b6e0: "drm/i915: Preallocate our mmu notifier
workequeu to unbreak cpu hotplug deadlock" from Oct 9, 2017, leads to
the following static checker warning:

	drivers/gpu/drm/i915/i915_gem_userptr.c:233 i915_mmu_notifier_find()
	error: 'mn' dereferencing possible ERR_PTR()

drivers/gpu/drm/i915/i915_gem_userptr.c
   201  static struct i915_mmu_notifier *
   202  i915_mmu_notifier_find(struct i915_mm_struct *mm)
   203  {
   204          struct i915_mmu_notifier *mn;
   205          int err = 0;
   206  
   207          mn = mm->mn;
   208          if (mn)
   209                  return mn;
   210  
   211          mn = i915_mmu_notifier_create(mm->mm);
   212          if (IS_ERR(mn))
   213                  err = PTR_ERR(mn);
                        ^^^^^^^^^^^^^^^^
error pointer here.

   214  
   215          down_write(&mm->mm->mmap_sem);
   216          mutex_lock(&mm->i915->mm_lock);
   217          if (mm->mn == NULL && !err) {
   218                  /* Protected by mmap_sem (write-lock) */
   219                  err = __mmu_notifier_register(&mn->mn, mm->mm);
   220                  if (!err) {
   221                          /* Protected by mm_lock */
   222                          mm->mn = fetch_and_zero(&mn);
   223                  }
   224          } else {
   225                  /* someone else raced and successfully installed the mmu
   226                   * notifier, we can cancel our own errors */
   227                  err = 0;
                        ^^^^^^^
We clear "err" here.

   228          }
   229          mutex_unlock(&mm->i915->mm_lock);
   230          up_write(&mm->mm->mmap_sem);
   231  
   232          if (mn) {
   233                  destroy_workqueue(mn->wq);
                        ^^^^^^^^^^^^^^^^^^^^^^^^
dereference.

   234                  kfree(mn);
   235          }
   236  
   237          return err ? ERR_PTR(err) : mm->mn;
   238  }

regards,
dan carpenter