[bug report] drm/xe: error pointer dereferences in test/xe_migrate.c

[Dan Carpenter]

Hello Matthew Brost,

The patch dd08ebf6c352: "drm/xe: Introduce a new DRM driver for Intel
GPUs" from Mar 30, 2023 (linux-next), leads to the following Smatch
static checker warning:

drivers/gpu/drm/xe/tests/xe_migrate.c:147 test_copy() warn: passing error pointer 'fence' to dma_fence_put()
drivers/gpu/drm/xe/tests/xe_migrate.c:165 test_copy() warn: passing error pointer 'fence' to dma_fence_put()
drivers/gpu/drm/xe/tests/xe_migrate.c:182 test_copy() warn: passing error pointer 'fence' to dma_fence_put()

drivers/gpu/drm/xe/tests/xe_migrate.c
    135 
    136         xe_map_memset(xe, &remote->vmap, 0, 0xd0, remote->size);
    137         fence = xe_migrate_clear(m, remote, remote->ttm.resource);

Btw, xe_migrate_clear() can return both error pointers and NULL but
there is no documentation what the NULL means and returning NULL looks
like a bug.

    138         if (!sanity_fence_failed(xe, fence, big ? "Clearing remote big bo" :
    139                                  "Clearing remote small bo", test)) {
    140                 retval = xe_map_rd(xe, &remote->vmap, 0, u64);
    141                 check(retval, expected, "remote first offset should be cleared",
    142                       test);
    143                 retval = xe_map_rd(xe, &remote->vmap, remote->size - 8, u64);
    144                 check(retval, expected, "remote last offset should be cleared",
    145                       test);
    146         }
--> 147         dma_fence_put(fence);
                              ^^^^^
This will crash with an error pointer dereference.

    148 
    149         /* Try to copy 0xc0 from remote to vram with 2MB or 64KiB/4KiB pages */
    150         xe_map_memset(xe, &remote->vmap, 0, 0xc0, remote->size);
    151         xe_map_memset(xe, &bo->vmap, 0, 0xd0, bo->size);

regards,
dan carpenter