adev->dm.dc is already checked in a few other if branches of the same
function so no reason not to check it everywhere else as well.

Moreover, admgpu_dm_fini() can be called from an error branch in
amdgpu_dm_init(), at which point it won't contain a valid dm.dc.
This might happen, for example, under OOM conditions.

Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.

Signed-off-by: Daniil Tatianin <d-tatia...@yandex-team.ru>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 589bee9acf16..6992bf766009 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1716,7 +1716,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
                dc_deinit_callbacks(adev->dm.dc);
 #endif
 
-       dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
+       if (adev->dm.dc)
+               dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
 
        if (dc_enable_dmub_notifications(adev->dm.dc)) {
                kfree(adev->dm.dmub_notify);
@@ -1731,7 +1732,9 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
                                      &adev->dm.dmub_bo_cpu_addr);
 
        if (adev->dm.hpd_rx_offload_wq) {
-               for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
+               int max_links = adev->dm.dc ? adev->dm.dc->caps.max_links : 0;
+
+               for (i = 0; i < max_links; i++) {
                        if (adev->dm.hpd_rx_offload_wq[i].wq) {
                                
destroy_workqueue(adev->dm.hpd_rx_offload_wq[i].wq);
                                adev->dm.hpd_rx_offload_wq[i].wq = NULL;
-- 
2.25.1

Reply via email to