[bug report] drm/i915/gt: Use i915_vm_put on ppgtt_create error paths

Dan Carpenter dan.carpenter at linaro.org
Wed Jan 10 18:51:55 UTC 2024


Hello Chris Wilson,

This is a semi-automatic email about new static checker warnings.

The patch c286558f5853: "drm/i915/gt: Use i915_vm_put on ppgtt_create 
error paths" from Sep 26, 2022, leads to the following Smatch 
complaint:

    drivers/gpu/drm/i915/gt/gen6_ppgtt.c:274 gen6_ppgtt_cleanup()
    warn: variable dereferenced before check 'ppgtt->base.pd' (see line 271)

drivers/gpu/drm/i915/gt/gen6_ppgtt.c
   256  static void gen6_ppgtt_free_pd(struct gen6_ppgtt *ppgtt)
   257  {
   258          struct i915_page_directory * const pd = ppgtt->base.pd;
                                                   ^^
pd is ppgtt->base.pd.

   259          struct i915_page_table *pt;
   260          u32 pde;
   261  
   262          gen6_for_all_pdes(pt, pd, pde)
                                      ^^
There is an unchecked dereference inside this loop macro.

   263                  if (pt)
   264                          free_pt(&ppgtt->base.vm, pt);
   265  }
   266  
   267  static void gen6_ppgtt_cleanup(struct i915_address_space *vm)
   268  {
   269          struct gen6_ppgtt *ppgtt = to_gen6_ppgtt(i915_vm_to_ppgtt(vm));
   270  
   271          gen6_ppgtt_free_pd(ppgtt);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^

   272          free_scratch(vm);
   273  
   274          if (ppgtt->base.pd)
                    ^^^^^^^^^^^^^^
Checked after an unchecked dereference.

   275                  free_pd(&ppgtt->base.vm, ppgtt->base.pd);
   276  
   277          mutex_destroy(&ppgtt->flush);
   278  }

regards,
dan carpenter


More information about the Intel-gfx mailing list