[Intel-gfx] [drm-intel:drm-intel-gt-next 7/8] drivers/gpu/drm/i915/selftests/intel_memory_region.c:227 igt_mock_reserve() error: 'mem' dereferencing possible ERR_PTR()

Dan Carpenter dan.carpenter at oracle.com
Fri Jul 2 09:30:32 UTC 2021 

tree:   git://anongit.freedesktop.org/drm-intel drm-intel-gt-next
head:   13c2ceb6addb6b14468e09b75832c98909eed8e7
commit: d53ec322dc7de32a59bf1c2a56b93e90fc2f1c28 [7/8] drm/i915/ttm: switch over to ttm_buddy_man
config: x86_64-randconfig-m001-20210630 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp at intel.com>
Reported-by: Dan Carpenter <dan.carpenter at oracle.com>

New smatch warnings:
drivers/gpu/drm/i915/selftests/intel_memory_region.c:227 igt_mock_reserve() error: 'mem' dereferencing possible ERR_PTR()

vim +/mem +227 drivers/gpu/drm/i915/selftests/intel_memory_region.c

adeca641bcb64f Abdiel Janulgue 2021-01-27  153  static int igt_mock_reserve(void *arg)
adeca641bcb64f Abdiel Janulgue 2021-01-27  154  {
adeca641bcb64f Abdiel Janulgue 2021-01-27  155  	struct intel_memory_region *mem = arg;
d53ec322dc7de3 Matthew Auld    2021-06-16  156  	struct drm_i915_private *i915 = mem->i915;
adeca641bcb64f Abdiel Janulgue 2021-01-27  157  	resource_size_t avail = resource_size(&mem->region);
adeca641bcb64f Abdiel Janulgue 2021-01-27  158  	struct drm_i915_gem_object *obj;
adeca641bcb64f Abdiel Janulgue 2021-01-27  159  	const u32 chunk_size = SZ_32M;
adeca641bcb64f Abdiel Janulgue 2021-01-27  160  	u32 i, offset, count, *order;
adeca641bcb64f Abdiel Janulgue 2021-01-27  161  	u64 allocated, cur_avail;
adeca641bcb64f Abdiel Janulgue 2021-01-27  162  	I915_RND_STATE(prng);
adeca641bcb64f Abdiel Janulgue 2021-01-27  163  	LIST_HEAD(objects);
adeca641bcb64f Abdiel Janulgue 2021-01-27  164  	int err = 0;
adeca641bcb64f Abdiel Janulgue 2021-01-27  165  
adeca641bcb64f Abdiel Janulgue 2021-01-27  166  	count = avail / chunk_size;
adeca641bcb64f Abdiel Janulgue 2021-01-27  167  	order = i915_random_order(count, &prng);
adeca641bcb64f Abdiel Janulgue 2021-01-27  168  	if (!order)
adeca641bcb64f Abdiel Janulgue 2021-01-27  169  		return 0;
adeca641bcb64f Abdiel Janulgue 2021-01-27  170  
d53ec322dc7de3 Matthew Auld    2021-06-16  171  	mem = mock_region_create(i915, 0, SZ_2G, I915_GTT_PAGE_SIZE_4K, 0);
d53ec322dc7de3 Matthew Auld    2021-06-16  172  	if (IS_ERR(mem)) {
d53ec322dc7de3 Matthew Auld    2021-06-16  173  		pr_err("failed to create memory region\n");
d53ec322dc7de3 Matthew Auld    2021-06-16  174  		err = PTR_ERR(mem);
d53ec322dc7de3 Matthew Auld    2021-06-16  175  		goto out_close;

"mem" is an error pointer.

d53ec322dc7de3 Matthew Auld    2021-06-16  176  	}
d53ec322dc7de3 Matthew Auld    2021-06-16  177  
adeca641bcb64f Abdiel Janulgue 2021-01-27  178  	/* Reserve a bunch of ranges within the region */
adeca641bcb64f Abdiel Janulgue 2021-01-27  179  	for (i = 0; i < count; ++i) {
adeca641bcb64f Abdiel Janulgue 2021-01-27  180  		u64 start = order[i] * chunk_size;
adeca641bcb64f Abdiel Janulgue 2021-01-27  181  		u64 size = i915_prandom_u32_max_state(chunk_size, &prng);
adeca641bcb64f Abdiel Janulgue 2021-01-27  182  
adeca641bcb64f Abdiel Janulgue 2021-01-27  183  		/* Allow for some really big holes */
adeca641bcb64f Abdiel Janulgue 2021-01-27  184  		if (!size)
adeca641bcb64f Abdiel Janulgue 2021-01-27  185  			continue;
adeca641bcb64f Abdiel Janulgue 2021-01-27  186  
adeca641bcb64f Abdiel Janulgue 2021-01-27  187  		size = round_up(size, PAGE_SIZE);
adeca641bcb64f Abdiel Janulgue 2021-01-27  188  		offset = igt_random_offset(&prng, 0, chunk_size, size,
adeca641bcb64f Abdiel Janulgue 2021-01-27  189  					   PAGE_SIZE);
adeca641bcb64f Abdiel Janulgue 2021-01-27  190  
adeca641bcb64f Abdiel Janulgue 2021-01-27  191  		err = intel_memory_region_reserve(mem, start + offset, size);
adeca641bcb64f Abdiel Janulgue 2021-01-27  192  		if (err) {
adeca641bcb64f Abdiel Janulgue 2021-01-27  193  			pr_err("%s failed to reserve range", __func__);
adeca641bcb64f Abdiel Janulgue 2021-01-27  194  			goto out_close;
adeca641bcb64f Abdiel Janulgue 2021-01-27  195  		}
adeca641bcb64f Abdiel Janulgue 2021-01-27  196  
adeca641bcb64f Abdiel Janulgue 2021-01-27  197  		/* XXX: maybe sanity check the block range here? */
adeca641bcb64f Abdiel Janulgue 2021-01-27  198  		avail -= size;
adeca641bcb64f Abdiel Janulgue 2021-01-27  199  	}
adeca641bcb64f Abdiel Janulgue 2021-01-27  200  
adeca641bcb64f Abdiel Janulgue 2021-01-27  201  	/* Try to see if we can allocate from the remaining space */
adeca641bcb64f Abdiel Janulgue 2021-01-27  202  	allocated = 0;
adeca641bcb64f Abdiel Janulgue 2021-01-27  203  	cur_avail = avail;
adeca641bcb64f Abdiel Janulgue 2021-01-27  204  	do {
adeca641bcb64f Abdiel Janulgue 2021-01-27  205  		u32 size = i915_prandom_u32_max_state(cur_avail, &prng);
adeca641bcb64f Abdiel Janulgue 2021-01-27  206  
adeca641bcb64f Abdiel Janulgue 2021-01-27  207  		size = max_t(u32, round_up(size, PAGE_SIZE), PAGE_SIZE);
adeca641bcb64f Abdiel Janulgue 2021-01-27  208  		obj = igt_object_create(mem, &objects, size, 0);
adeca641bcb64f Abdiel Janulgue 2021-01-27  209  		if (IS_ERR(obj)) {
d53ec322dc7de3 Matthew Auld    2021-06-16  210  			if (PTR_ERR(obj) == -ENXIO)
adeca641bcb64f Abdiel Janulgue 2021-01-27  211  				break;
d53ec322dc7de3 Matthew Auld    2021-06-16  212  
adeca641bcb64f Abdiel Janulgue 2021-01-27  213  			err = PTR_ERR(obj);
adeca641bcb64f Abdiel Janulgue 2021-01-27  214  			goto out_close;
adeca641bcb64f Abdiel Janulgue 2021-01-27  215  		}
adeca641bcb64f Abdiel Janulgue 2021-01-27  216  		cur_avail -= size;
adeca641bcb64f Abdiel Janulgue 2021-01-27  217  		allocated += size;
adeca641bcb64f Abdiel Janulgue 2021-01-27  218  	} while (1);
adeca641bcb64f Abdiel Janulgue 2021-01-27  219  
adeca641bcb64f Abdiel Janulgue 2021-01-27  220  	if (allocated != avail) {
adeca641bcb64f Abdiel Janulgue 2021-01-27  221  		pr_err("%s mismatch between allocation and free space", __func__);
adeca641bcb64f Abdiel Janulgue 2021-01-27  222  		err = -EINVAL;
adeca641bcb64f Abdiel Janulgue 2021-01-27  223  	}
adeca641bcb64f Abdiel Janulgue 2021-01-27  224  
adeca641bcb64f Abdiel Janulgue 2021-01-27  225  out_close:
adeca641bcb64f Abdiel Janulgue 2021-01-27  226  	kfree(order);
adeca641bcb64f Abdiel Janulgue 2021-01-27 @227  	close_objects(mem, &objects);
                                                                      ^^^
Dereferenced inside function.

d53ec322dc7de3 Matthew Auld    2021-06-16  228  	intel_memory_region_put(mem);
adeca641bcb64f Abdiel Janulgue 2021-01-27  229  	return err;
adeca641bcb64f Abdiel Janulgue 2021-01-27  230  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

More information about the Intel-gfx mailing list