Re: [PATCH 4/4] drm/crtc: add drmm_crtc_alloc_with_planes()

: gcc-9 (Debian 9.3.0-15) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot Reported-by: Dan Carpenter smatch warnings: drivers/gpu/drm/drm_crtc.c:343 drm_crtc_init_with_planes() error: uninitialized symbol 'ap'. drivers/gpu/drm/drm_

[bug report] drm/panel: Add panel driver for the Mantix MLAF057WE51-X DSI panel

de); 212 213 mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED; 214 connector->display_info.width_mm = mode->width_mm; 215 connector->display_info.height_mm = mode->height_mm; 216 drm_mode_probed_add(connector, mode);

[bug report] drm/mcde: Add new driver for ST-Ericsson MCDE

566 mcde->flow_mode); "val" not initialized on this path. 567 break; 568 } 569 570 writel(val, mcde->regs + sync); 571 572 /* Set up pixels per line and lines per frame */ regards, dan carpenter _

[PATCH] drm/vc4: hdmi: Fix off by ones in vc4_hdmi_read/write()

The variant->registers[] has ->num_registers elements so the > comparison needs to be changes to >= to prevent an out of bounds access. Fixes: 311e305fdb4e ("drm/vc4: hdmi: Implement a register layout abstraction") Signed-off-by: Dan Carpenter --- drivers/gpu/drm/vc4/vc4_h

[PATCH] drm/vc4: hdmi: Fix NULL vs IS_ERR() checks in vc5_hdmi_init_resources()

The devm_ioremap() function never returns error pointers, it returns NULL. Fixes: 8323989140f3 ("drm/vc4: hdmi: Support the BCM2711 HDMI controllers") Signed-off-by: Dan Carpenter --- drivers/gpu/drm/vc4/vc4_hdmi.c | 32 1 file changed, 16 inserti

Re: [PATCH 2/6] drm/xen-front: Fix misused IS_ERR_OR_NULL checks

Looks great! Thanks. Reviewed-by: Dan Carpenter regards, dan carpenter ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 2/6] drm/xen-front: Fix misused IS_ERR_OR_NULL checks

this and the rest of misused places with IS_ERR_OR_NULL in the > >> driver. > >> > >> Fixes:  c575b7eeb89f: "drm/xen-front: Add support for Xen PV display > >> frontend" > > > > Again forgot to Cc stable? > > I was just not sure if thes

Re: [PATCH] drm: amdgpu: Use the correct size when allocating memory

/* number of mapped entries */ 45 unsigned int orig_nents; /* original size of list */ 46 }; regards, dan carpenter ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm: amdgpu: Use the correct size when allocating memory

On Mon, Aug 10, 2020 at 08:41:14PM +0200, Marion & Christophe JAILLET wrote: > > Le 10/08/2020 à 17:42, Dan Carpenter a écrit : > > On Sun, Aug 09, 2020 at 10:34:06PM +0200, Christophe JAILLET wrote: > > > When '*sgt' is allocated, we must allocated 'sizeo

Re: [PATCH] drm: amdgpu: Use the correct size when allocating memory

On Tue, Aug 11, 2020 at 10:57:02AM +0300, Dan Carpenter wrote: > On Mon, Aug 10, 2020 at 08:41:14PM +0200, Marion & Christophe JAILLET wrote: > > > > Le 10/08/2020 à 17:42, Dan Carpenter a écrit : > > > On Sun, Aug 09, 2020 at 10:34:06PM +0200, Christophe JAILLET w

[PATCH] drm/etnaviv: Fix a leak in submit_pin_objects()

If the mapping address is wrong then we have to release the reference to it before returning -EINVAL. Fixes: 00ddc0b2 ("drm/etnaviv: implement softpin") Signed-off-by: Dan Carpenter --- >From static analysis. Untested. drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 4 +++- 1

[PATCH] drm/amdgpu: off by on in amdgpu_device_attr_create_groups() error handling

847c38f7 ("drm/amdgpu: optimize amdgpu device attribute code") Signed-off-by: Dan Carpenter --- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c index

Re: [PATCH] drm/amdgpu: off by on in amdgpu_device_attr_create_groups() error handling

On Wed, May 20, 2020 at 02:05:19PM +0200, Christian König wrote: > Am 20.05.20 um 14:00 schrieb Dan Carpenter: > > This loop in the error handling code should start a "i - 1" and end at > > "i == 0". Currently it starts a "i" and ends at "i == 1&

[PATCH v2] drm/amdgpu: off by on in amdgpu_device_attr_create_groups() error handling

847c38f7 ("drm/amdgpu: optimize amdgpu device attribute code") Signed-off-by: Dan Carpenter --- v2: style change drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/

[PATCH v3] drm/amdgpu: off by one in amdgpu_device_attr_create_groups() error handling

847c38f7 ("drm/amdgpu: optimize amdgpu device attribute code") Signed-off-by: Dan Carpenter --- v2: style change v3: Fix embarrassing typo in the subject drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/d

Re: [PATCH v6] drm/ioctl: Add a ioctl to set and get a label on GEM objects

.config) compiler: gcc-9 (Debian 9.3.0-13) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kbuild test robot Reported-by: Dan Carpenter New smatch warnings: drivers/gpu/drm/drm_gem.c:1004 drm_gem_get_label() warn: maybe return -EFAULT instead of the bytes remaining

Re: Re: [PATCH] drm/nouveau/clk/gm20b: Fix memory leak in gm20b_clk_new()

The original patch was basically fine. Just add a Fixes tag and resend. regards, dan carpenter ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm/nouveau/clk/gm20b: Fix memory leak in gm20b_clk_new()

cessful return from this function? Heh. You're right. The patch is freeing "clk" on the success path so that doesn't work. regards, dan carpenter ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH v3 09/13] device core: Introduce multiple dma pfn offsets

dma_pfn_offset_region *r; > + > + if (!dev) > + return -ENODEV; > + > + if (!pfn_offset) > + return 0; > + > + r = devm_kcalloc(dev, 1, sizeof(struct dma_pfn_offset_region), > + GFP_KERNEL); Use:r = devm_kzalloc(dev, sizeof(*r), GFP_KERNEL); > + if (!r) > + return -ENOMEM; > + > + r->uniform_offset = true; > + r->pfn_offset = pfn_offset; > + > + return 0; > +} This function doesn't seem to do anything useful. Is part of it missing? > +EXPORT_SYMBOL_GPL(attach_uniform_dma_pfn_offset); > + regards, dan carpenter ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH v3 09/13] device core: Introduce multiple dma pfn offsets

return -ENOMEM; r->uniform_offset = true; r->pfn_offset = pfn_offset; return 0; The code allocates "r" and then doesn't save it anywhere so there is no point. regards, dan carpenter ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH v8 4/8] PM / EM: add support for other devices than CPUs in Energy Model

-m021-20200605 (attached as .config) compiler: gcc-9 (Debian 9.3.0-13) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot Reported-by: Dan Carpenter smatch warnings: kernel/power/energy_model.c:316 em_dev_register_perf_domain() error: we previously

Re: [PATCH v8 4/8] PM / EM: add support for other devices than CPUs in Energy Model

On Mon, Jun 08, 2020 at 01:34:37PM +0100, Lukasz Luba wrote: > Hi Dan, > > Thank you for your analyzes. > > On 6/8/20 12:51 PM, Dan Carpenter wrote: > > Hi Lukasz, > > > > I love your patch! Perhaps something to improve: > > > > url: > > h

Re: [PATCH v8 4/8] PM / EM: add support for other devices than CPUs in Energy Model

It's not really a proper bug report so it doesn't deserve a reported-by. Thanks, though! regards, dan carpenter ___ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH] drm/amd/display: Fix indenting in dcn30_set_output_transfer_func()

These lines are a part of the if statement and they are supposed to be indented one more tab. Signed-off-by: Dan Carpenter --- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30

Re: [PATCH] drm/amd/display: Fix indenting in dcn30_set_output_transfer_func()

On Mon, Jun 08, 2020 at 10:16:27AM -0700, Joe Perches wrote: > On Mon, 2020-06-08 at 17:16 +0300, Dan Carpenter wrote: > > These lines are a part of the if statement and they are supposed to > > be indented one more tab. > > > > Signed-off-by: Dan Carpenter >

[patch] drm/edid: fix a debug message

There is an extra semi-colon on the if statement so the debug output always says "Failed to write EDID checksum" even when it didn't fail. Fixes: 559be30cb74d ('drm/i915: Implement the intel_dp_autotest_edid function for DP EDID complaince tests') Signed-off-by: Dan

drm/nouveau/fb: namespace + nvidia gpu names (no binary change)

1301 break; 1302 } 1303 1304 kfree(train); 1305 return ret; 1306 } regards, dan carpenter

gma500: initial medfield merge

emp & PIPEACONF_PIPE_STATE) But removing delays is slightly risky unless you can test it on hardware. 103 break; 104 } 105 } regards, dan carpenter

drm/atomic: add commit_planes_on_crtc helper

1244 if (crtc_funcs->atomic_flush) ^^ Unchecked dereference. 1245 crtc_funcs->atomic_flush(crtc); 1246 } regards, dan carpenter

[patch] drm/vc4: checking for NULL instead of IS_ERR

vc4_plane_init() returns an ERR_PTR on error, it doesn't return NULL. This was obviously intended because the next lines call PTR_ERR(primary_plane) already. Fixes: c8b75bca92cb ('Eric Anholt ') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/driv

[patch] drm/amdgpu: cleanup on error in amdgpu_cs_ioctl()

We recently changed the locking in this function and now there is a missing unlock on error. Also there are some other resources that we should probably release as well... Fixes: f48b2659f521 ('drm/amdgpu: fix the broken vm->mutex V2') Signed-off-by: Dan Carpenter --- I'm not

[patch] drm/i915/mocs: || vs | typo in get_mocs_settings()

It seems pretty clear that bitwise OR was intended here and not logical OR. Fixes: 6fc29133eafb ('drm/i915/gen9: Add WaDisableSkipCaching') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/i915/intel_mocs.c b/drivers/gpu/drm/i915/intel_mocs.c index 8f96c40..3c1482b 10

[patch] drm/amdgpu: missing bounds check in amdgpu_set_pp_force_state()

faces for powerplay.') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c index 589b36e..ce9e97f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c @@ -275,25 +275,23 @@ stati

[patch] drm/amdgpu: missing bounds check in amdgpu_set_pp_force_state()

On Thu, Jun 16, 2016 at 09:26:03AM +0200, walter harms wrote: > > > Am 16.06.2016 08:41, schrieb Dan Carpenter: > > There is no limit on high "idx" can go. It should be less than > > ARRAY_SIZE(data.states) which is 16. > > > > The "data" va

[patch] drm/amdgpu: missing bounds check in amdgpu_set_pp_force_state()

Sure, I'll resend. Unsigned is a little cleaner. There is no new error code/message or change in behavior though either way. regards, dan carpenter

[patch v2] drm/amdgpu: missing bounds check in amdgpu_set_pp_force_state()

('drm/amd/powerplay: add some sysfs interfaces for powerplay.') Signed-off-by: Dan Carpenter --- v2: make idx unsigned diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c index 589b36e..0e13d80 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c

[patch] drm/amdgpu: precedence bug in amdgpu_device_init()

! has higher precedence than bitwise & so we need to add parenthesis for this to work as intended. Fixes: 048765ad5af7 ('amdgpu: fix asic initialization for virtualized environments (v2)') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/d

[patch] drm: rockchip: signedness bug in dw_mipi_dsi_get_lane_bps()

"bpp" needs to be signed for the error handling to work. Fixes: 84e05408fcfe ('drm: rockchip: Support Synopsys DW MIPI DSI') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi.c index 7bfe243..c35e5af 1006

[patch] drm/amd/powerplay: indent a couple if statements

We recently redid the indenting, but missed these two if statements. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppevvmath.h b/drivers/gpu/drm/amd/powerplay/hwmgr/ppevvmath.h index b7429a5..b10df32 100644 --- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppevvmath.h

[patch] drm/vmwgfx: fix a NULL dereference

We dereference "eaction->event" inside the call to drm_send_event_locked() so should hold off on setting it to NULL until afterward. Fixes: fb740cf2492c ("drm: Create drm_send_event helpers") Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fen

drm/i915: Decouple execbuf uAPI from internal implementation

user_ring_map[user_ring_id]]; 1414 } 1415 1416 if (!intel_ring_initialized(*ring)) { 1417 DRM_DEBUG("execbuf with invalid ring: %u\n", user_ring_id); 1418 return -EINVAL; 1419 } regards, dan carpenter

[patch] drm/mediatek/mtk_mipi_tx: checking the wrong variable

We should be checking "phy_provider" here not "phy". Fixes: 2e54c14e310f ('drm/mediatek: Add DSI sub driver') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/mediatek/mtk_mipi_tx.c b/drivers/gpu/drm/mediatek/mtk_mipi_tx.c index cf8f38d..1c366f8 100644

[patch] drm/tegra: sor: Double free on error

"brick" is allocated with devm_kzalloc() so freeing it with kfree() leads to a double free. We can just delete it. Fixes: a7ba8310c7f5 ('drm/tegra: sor: Implement sor1_brick clock') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/d

[patch 1/2] qxl: check for kmap failures

If kmap fails, it leads to memory corruption. Fixes: f64122c1f6ad ('drm: add new QXL driver. (v1.4)') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index 56e1d63..6e6c760 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/d

[patch 2/2] qxl: silence uninitialized variable warning

GCC doesn't complain about this but my static checker does. We're passing "drawable" before initializing it. It's not actually used so it's harmless and I just removed it. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/dr

[patch] drm/rockchip: fix a couple off by one bugs

The priv->crtc_funcs[] array has ROCKCHIP_MAX_CRTC elements so > should be >= here. Fixes: 2048e3286f34 ('drm: rockchip: Add basic drm driver') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_

[patch] drm/msm: return -EFAULT instead of bytes remaining

copy_to/from_user returns the number of bytes remaining to be copied but we want to return -EFAULT. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/msm/msm_perf.c b/drivers/gpu/drm/msm/msm_perf.c index 830857c..17fe4e5 100644 --- a/drivers/gpu/drm/msm/msm_perf.c +++ b/drivers/gpu/drm

[patch] gma500: remove duplicate FB_REG09 define

The FB_REG09 define is cut and pasted twice so we can remove the second instance. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/gma500/mid_bios.c b/drivers/gpu/drm/gma500/mid_bios.c index a97e38e..d75ecb3 100644 --- a/drivers/gpu/drm/gma500/mid_bios.c +++ b/drivers/gpu/drm/gma500

[patch] drm/tegra: sor - missing unlock on error

We should unlock before returning the error code. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c index 27c979b..64f57fa 100644 --- a/drivers/gpu/drm/tegra/sor.c +++ b/drivers/gpu/drm/tegra/sor.c @@ -516,7 +516,7 @@ static int

[patch] gma500: out of bounds read in debug code comma

The code assume that this array has 32 elements but because of a missing comma, then it only has 31. This array is only used when error occurs and debugging is enabled so it's not very serious. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c b/dr

drm/i2c: tda998x: free the CEC device on encoder_destroy

ly this new check can be removed? 1195 i2c_unregister_device(priv->cec); 1196 kfree(priv); regards, dan carpenter

[patch] drm/i915: precedence bug in hsw_compute_wm_results()

The '!' operation has higher precedence than the compare so probably this test is never true. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c index a5a9959..0b9d9a7 100644 --- a/drivers/gpu/drm/i915/intel_pm.c +++ b/drive

[patch] drm/i915: unbreak i915_gem_object_ggtt_unbind()

There is an extra semi-colon here so we just leak and never unbind anything. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 735f43f..a582540 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c

[patch v2] drm/i915: fix a limit check in hsw_compute_wm_results()

The '!' here was not intended. Since '!' has higher precedence than compare, it means the check is never true. Signed-off-by: Dan Carpenter --- v2: My first patch was wrong. diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c index 96234c6..

[patch] drm/i915: use _safe version of list_for_each

We sometimes call i915_vma_unbind() inside the loop and that can free the vma. Signed-off-by: Dan Carpenter --- Static checker stuff. Untested. diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c index 9b3b5f8..5249735 100644 --- a/drivers/gpu

re: drm/i915: Switch eviction code to use vmas

This often frees the "vma". 144 145 list_del_init(&vma->exec_list); ^^^ Dereference. 146 drm_gem_object_unrefe

[patch] drm/omap: tiler: clear buffer properly

We're taking the sizeof() the wrong thing so it doesn't clear the whole buffer. Signed-off-by: Dan Carpenter --- I can't compile this. diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c index 9b794c9..acf6678 100644 --- a/drivers/

[patch 1/2] gpu: host1x: fix an integer overflow check

n overflow as well, but I think it's still safe because we check both "num_cmdbufs" and "num_relocs" again in this test. Signed-off-by: Dan Carpenter --- This is something I spotted in code review. I can't actually compile this code. I assume this overflow test

[patch 2/2] gpu: host1x: returning success instead of -ENOMEM

There is a mistake here so it returns PTR_ERR(NULL) which is success instead of -ENOMEM. Signed-off-by: Dan Carpenter --- I can't compile this. diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c index cc80766..6cf41da 100644 --- a/drivers/gpu/host1x/job.c +++ b/drivers/gpu/h

[patch -next] drm/prime: double lock typo

There is a typo so deadlocks on error instead of unlocking. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 7ae2bfc..276d470 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -552,7 +552,7 @@ fail

re: drm/radeon: add audio support for DCE6/8 GPUs (v12)

dereference. 90 91 if (!dig->afmt->pin) ^^^ Patch adds check. 92 return; 93 regards, dan carpenter ___ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel

[patch] drm/radeon: signedness bug in kv_dpm.c

n ->DeepSleepDivId and I wasn't able to determine how that is used. This is a static checker fix and I have not tested it. Signed-off-by: Dan Carpenter --- I considered making "i" signed but that doesn't actually change anything because the tests have to end on zero anyw

[patch] drm/radeon: clean up r600_free_extended_power_table()

kfree() can accept NULL pointers so I have removed the checks. Also I've used a pointer to shorten the lines. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c index fa0de46..e65f211 100644 --- a/drivers/gpu/drm/radeon/r600_

[patch] drm/i915: cleanup a min_t() cast

The lower layers of sysfs will not allow an "offset" of more than GEN7_L3LOG_SIZE and also l3_access_valid() caps it a second time. But it's a little easier to audit if we don't have to worry that the subtraction will result in negative values. Signed-off-by: Dan Carpenter

[patch] drm/i915: precendence bug in GT_PARITY_ERROR()

The | operation has higher precedence than "?:" so the macro always returns GT_RENDER_L3_PARITY_ERROR_INTERRUPT_S1. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h index c4f9bef..87b 100644 --- a/drivers/gpu/drm/i915/

[patch] drm/nouveau: off by one in nouveau_drm_vblank_enable()

The test here should be ">= ARRAY_SIZE()" instead of "> ARRAY_SIZE()". Signed-off-by: Dan Carpenter Acked-by: Maarten Lankhorst --- Somehow this wasn't applied when I sent it earlier. diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouv

[patch -next] drm/radeon/dpm/btc: off by one in btc_set_mc_special_registers()

It should be ">=" instead of ">" here. The table->mc_reg_address[] array has SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE (16) elements. Signed-off-by: Dan Carpenter --- Resend. diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c index bab0185.

[patch] drm/radeon/dpm: off by one in si_set_mc_special_registers()

These checks should be ">=" instead of ">". j is used as an offset into the table->mc_reg_address[] array and that has SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE (16) elements. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/

[PATCH 2/2] move imx-hdmi to bridge/dw-hdmi

ch depends on imx-drm, so move the imx hdmi drvier out > to drm/bridge and rename imx-hdmi to dw-hdmi > No Signed-off-by: line. regards, dan carpenter

[bug report] drm/bridge: Add ti-tfp410 DVI transmitter driver

dev_info(dvi->dev, "Connector's ddc i2c bus found\n"); 150 else 151 ret = -EPROBE_DEFER; 152 153 fail: 154 of_node_put(ep); 155 of_node_put(connector_node); 156 of_node_put(ddc_phandle); 157 return ret; 158 } regards, dan carpenter

[bug report] drm/amdgpu: Add support for CIK parts

doesn't at all... :/ Just have every function unwind it's own allocations, doing it that way basically writes a mirroring de-allocate function for every allocator for no effort. 6294 mutex_unlock(&adev->pm.mutex); 6295 DRM_ERROR("amdgpu: dpm initialization failed\n"); 6296 return ret; 6297 } regards, dan carpenter

[patch] drm: mxsfb: drm_dev_alloc() returns error pointers

We should be checking for IS_ERR() instead of NULL because drm_dev_alloc() returns error pointers. Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller") Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c index 79

[bug report] drm/i915: Small compaction of the engine init code

974 } 1975 1976 return ret; 1977 } regards, dan carpenter

[patch] drm/tegra: checking for IS_ERR() instead of NULL

The tegra_sor_hdmi_find_settings() function returns NULL on error and not an ERR_PTR. Fixes: 459cc2c6800b ('drm/tegra: sor: Add HDMI support') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c index da1715e..08c5461 100644 --- a/drive

drm/amdgpu: implement cgs gpu memory callbacks

/amd/amdgpu/tonga_smc.c:406 tonga_smu_populate_single_firmware_entry() warn: should '((header->jt_offset)) << 2' be a 64 bit type? drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c:615 amdgpu_gem_op_ioctl() warn: should 'robj->tbo.mem.page_alignment << 12' be a 64 bit type? regards, dan carpenter

drm/amdgpu: implement cgs gpu memory callbacks

ents[0].fpfn << PAGE_SHIFT; max_offset = (u64)obj->placements[0].lpfn << PAGE_SHIFT; But the larger questions aer why is min_offset a u64, and can the shift actually wrap? I'm just looking at static checker warnings, and I'm not very familiar with this code so I don't know the answers. regards, dan carpenter

drm/amdgpu: implement cgs gpu memory callbacks

On Tue, Aug 25, 2015 at 02:07:21AM +, Zhou, David(ChunMing) wrote: > >and can the shift actually > > wrap? > [DZ] of course, adding shift wrap is better. fpfn/lpfn is page number, so > <

[PATCHv6 5/5] drm: bridge: anx78xx: Add anx78xx driver support by analogix.

else > + sp_reg_clear_bits(anx78xx, TX_P2, SP_AUD_CH_STATUS_BASE + 5, > + SP_I2S_CHANNEL_NUM_MASK | SP_AUDIO_LAYOUT); > + > + /* transfer audio channel status from HDMI Rx to Slimport Tx */ > + for (i = 1; i <= SP_AUD_CH_STATUS_REG_NUM; i++) { > + sp_reg_read(anx78xx, RX_P0, SP_AUD_SPDIF_CH_STATUS_BASE + i, > + &val); > + sp_reg_write(anx78xx, TX_P2, SP_AUD_CH_STATUS_BASE + i, > + val); > + } Either this loop is off by one or the loop in sp_hdmi_audio_samplechg_int() is off by one. Also just call that function instead of re-implimenting it here. > + > + /* enable audio */ > + sp_enable_audio_output(anx78xx, true); > +} > + > +static bool sp_config_audio_output(struct anx78xx *anx78xx) > +{ > + u8 val; > + > + switch (sp.tx_ao_state) { > + default: > + case AO_INIT: > + case AO_CTS_RCV_INT: > + case AO_AUDIO_RCV_INT: > + sp_reg_read(anx78xx, RX_P0, SP_HDMI_STATUS_REG, &val); > + if (!val & SP_HDMI_MODE) { This is a precendence error. It should be: if (!(val & SP_HDMI_MODE)) { > + sp.tx_ao_state = AO_INIT; > + return true; > + } > + break; regards, dan carpenter

[patch] drm/radeon: remove some buggy dead code

The calculation of "num_shader_engines" has a precedence bug because the right shift happens before the mask, but this variable is never used so we can just delete it. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergre

[patch] drm/gma500: some return code fixes

ve made those return -ENOMEM. Fixes: b219372dff81 ('drm/gma500: Make SGX MMU driver actually do something') Signed-off-by: Dan Carpenter --- These are static checker things and I have not tested them. It's always a little risky adding new error paths which haven't been tested b

drm/radeon: fix AGP userptr handling

turn; 776 } 777 #endif 778 779 for (i = 0; i < ttm->num_pages; i++) { 780 if (gtt->ttm.dma_address[i]) { 781 pci_unmap_page(rdev->pdev, gtt->ttm.dma_address[i], 782 PAGE_SIZE, PCI_DMA_BIDIRECTIONAL); regards, dan carpenter

[patch] drm/layerscape: fix a signedness bug

"index" needs to be signed for the error handling to work. Really "ret" should be an int as well. Fixes: 109eee2f2a18 ('drm/layerscape: Add Freescale DCU DRM driver') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plan

[patch 4/4 v2] drm/qxl: integer overflow in qxl_alloc_surf_ioctl()

The size calculation can overflow. I don't know if this leads to memory corruption, but it causes a static checker warning. Signed-off-by: Dan Carpenter --- v2: I don't know think the size is capped anywhere. In my first version of this patch, I introduced a divide by zero bug. di

[PATCHv3 3/3] drm: bridge: anx78xx: Add anx78xx driver support by analogix.

(sp.tx_sc_state) { > + case SC_INIT: > + sp.tx_sc_state++; > + case SC_CHECK_CABLE_TYPE: > + case SC_WAITTING_CABLE_TYPE: > + default: > + if (sp_tx_get_cable_type(anx78xx, CHECK_AUXCH) == > +DWN_STRM_IS_NULL) { > + sp.tx_sc_state++; > + if (sp.tx_sc_state >= SC_WAITTING_CABLE_TYPE) { > + sp.tx_sc_state = SC_NOT_CABLE; > + dev_dbg(dev, "Can not get cable type!\n"); > + } > + break; > + } > + > + sp.tx_sc_state = SC_SINK_CONNECTED; > + case SC_SINK_CONNECTED: > + if (sp_tx_get_downstream_connection(anx78xx)) > + goto_next_system_state(anx78xx); > + break; > + case SC_NOT_CABLE: > + sp_vbus_power_off(anx78xx); > + reg_hardware_reset(anx78xx); > + break; > + } > +} > + > +/**start EDID process/ > +static void sp_tx_enable_video_input(struct anx78xx *anx78xx, u8 enable) > +{ > + struct device *dev = &anx78xx->client->dev; > + u8 c; > + > + sp_read_reg(anx78xx, TX_P2, VID_CTRL1, &c); > + if (enable) { > + c = (c & 0xf7) | VIDEO_EN; > + sp_write_reg(anx78xx, TX_P2, VID_CTRL1, c); > + dev_dbg(dev, "Slimport Video is enabled!\n"); > + > + } else { > + c &= ~VIDEO_EN; > + sp_write_reg(anx78xx, TX_P2, VID_CTRL1, c); > + dev_dbg(dev, "Slimport Video is disabled!\n"); > + } > +} > + > +static u8 sp_get_edid_detail(u8 *data_buf) > +{ > + u16 pixclock_edid; > + > + pixclock_edid = u16)data_buf[1] << 8)) > + | ((u16)data_buf[0] & 0xFF)); > + if (pixclock_edid <= 5300) > + return LINK_1P62G; > + else if ((pixclock_edid > 5300) && (pixclock_edid <= 8900)) > + return LINK_2P7G; > + else if ((pixclock_edid > 8900) && (pixclock_edid <= 18000)) > + return LINK_5P4G; > + else > + return LINK_6P75G; > +} > + > +static u8 sp_parse_edid_to_get_bandwidth(struct anx78xx *anx78xx) > +{ > + struct device *dev = &anx78xx->client->dev; > + u8 desc_offset = 0; > + u8 i, bandwidth, temp; > + > + bandwidth = LINK_1P62G; > + temp = LINK_1P62G; > + i = 0; > + while (i < 4 && sp.edid_blocks[0x36 + desc_offset] != 0) { > + temp = sp_get_edid_detail(sp.edid_blocks + 0x36 + desc_offset); > + dev_dbg(dev, "bandwidth via EDID : %x\n", (u16)temp); > + if (bandwidth < temp) > + bandwidth = temp; > + if (bandwidth > LINK_5P4G) > + break; > + desc_offset += 0x12; > + ++i; > + } > + return bandwidth; > +} > + > +static void sp_tx_aux_wr(struct anx78xx *anx78xx, u8 offset) > +{ > + sp_write_reg(anx78xx, TX_P0, BUF_DATA_0, offset); > + sp_write_reg(anx78xx, TX_P0, AUX_CTRL, 0x04); > + sp_write_reg_or(anx78xx, TX_P0, AUX_CTRL2, AUX_OP_EN); > + sp_wait_aux_op_finish(anx78xx, &sp.edid_break); > +} > + > +static void sp_tx_aux_rd(struct anx78xx *anx78xx, u8 len_cmd) > +{ > + sp_write_reg(anx78xx, TX_P0, AUX_CTRL, len_cmd); > + sp_write_reg_or(anx78xx, TX_P0, AUX_CTRL2, AUX_OP_EN); > + sp_wait_aux_op_finish(anx78xx, &sp.edid_break); > +} > + > +static u8 sp_tx_get_edid_block(struct anx78xx *anx78xx) > +{ > + struct device *dev = &anx78xx->client->dev; > + u8 c; > + > + sp_tx_aux_wr(anx78xx, 0x7e); > + sp_tx_aux_rd(anx78xx, 0x01); > + sp_read_reg(anx78xx, TX_P0, BUF_DATA_0, &c); > + dev_dbg(dev, "EDID Block = %d\n", (int)(c + 1)); > + > + if (c > 3) > + c = 1; > + return c; > +} > + > +static void sp_edid_read(struct anx78xx *anx78xx, u8 offset, > + u8 *pblock_buf) > +{ > + u8 data_cnt, cnt; > + u8 c; > + > + sp_tx_aux_wr(anx78xx, offset); > + sp_tx_aux_rd(anx78xx, 0xf5); > + data_cnt = 0; > + cnt = 0; > + > + while ((data_cnt) < 16) { > + sp_read_reg(anx78xx, TX_P0, BUF_DATA_COUNT, &c); > + > + if ((c & 0x1f) != 0) { Double negative. The right times to compare == 0 and != 0 are with *cmp() functions and when talking about zero as a number. Here zero is a boolean so it should just be "if (c & 0x1f) {" > + data_cnt = data_cnt + c; > + do { > + sp_read_reg(anx78xx, TX_P0, BUF_DATA_0 + c - 1, > + &(pblock_buf[c - 1])); > + if (c == 1) > + break; > + } while (c--); The "if (c == 1)" condition means that c is a number 2-255 so this "while (c--)" condition is always true. Remove the earlier condition and do this instead: } while (--c) Anyway, gotta run. regards, dan carpenter

[patch 1/4] drm/amdgpu: unwind properly in amdgpu_cs_parser_init()

of the function. 3) Removed some initializers which are no longer needed. Reported-by: Ilja Van Sprundel Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 3b355ae..abb257d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgp

[patch 2/4] drm/amdgpu: integer overflow in amdgpu_info_ioctl()

The "alloc_size" calculation can overflow leading to memory corruption. Reported-by: Ilja Van Sprundel Signed-off-by: Dan Carpenter --- The amdgpu_asic_read_register() functions seem likely to be slow. They iterate through all the registers to find the correct register to read. di

[patch 3/4] drm/amdgpu: info leak in amdgpu_gem_metadata_ioctl()

There is no limit on args->data.data_size_bytes so we could read beyond the end of the args->data.data[] array. Reported-by: Ilja Van Sprundel Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c index 5839fab..d

[patch 4/4] drm/amdgpu: integer overflow in amdgpu_mode_dumb_create()

args->size is a u64. arg->pitch and args->height are u32. The multiplication will overflow instead of using the high 32 bits as intended. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c index dac14de..20230

[patch 1/4] drm/amdgpu: unwind properly in amdgpu_cs_parser_init()

On Wed, Sep 23, 2015 at 01:13:21PM -0400, Alex Deucher wrote: > Applied. thanks! Ugh. I'm sorry, I have a signedness bug in this patch. That was really sloppy of me. Should a send a v2 or a fixup? regards, dan carpenter

[patch] drm/amdgpu: signedness bug in amdgpu_cs_parser_init()

The "i" variable should be signed or it leads to a crash in the error handling code. Fixes: 1d263474c441 ('drm/amdgpu: unwind properly in amdgpu_cs_parser_init()') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdg

[patch] drm/mgag200: set an error code

We need to set "ret" if vmalloc() fails. Fixes: aec9e12953e7 ('drm/mgag200: Fix error handling paths in fbdev driver') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c b/drivers/gpu/drm/mgag200/mgag200_fb.c index b35b5b2..2a1049e 100644 -

[patch] drm/layerscape: fix a signedness bug

janitors on static checker fixes so I can monitor what fixes you send? regards, dan carpenter

[patch] drm/nouveau/gem: silence uninitialized variable warning

The static checker checker is warning that we could hit the first continue; on every iteration through the loop and never initialize "ret". It seems unlikely but we may as well silence the warning. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/d

[patch] drm: ARM HDLCD - fix an error code

We accidentally return PTR_ERR(NULL) which is success instead of a negative error code. Fixes: 879e40bea6f2 ('drm: ARM HDLCD - get rid of devm_clk_put()') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/arm/hdlcd_drv.c b/drivers/gpu/drm/arm/hdlcd_drv.c index 734849f..3ac1

drm: bridge: analogix/dp: Fix the possible dead lock in bridge disable time

_clear_hotplug_interrupts(dp); 884 analogix_dp_unmute_hpd_interrupt(dp); 885 } 886 887 return IRQ_HANDLED; 888 } regards, dan carpenter

[patch] drm/rockchip: inno_hdmi: fix an error code

On Fri, Feb 26, 2016 at 02:26:23PM +0800, Yakir Yang wrote: > Dan, > > On 02/26/2016 05:30 AM, Dan Carpenter wrote: > >We were accidentally returning PTR_ERR(NULL) which means success when we > >wanted to return a negative error code. > > > >Fixes: 412d4

[patch] drm: atmel-hlcdc: fix a NULL check

If kmalloc() returned NULL we would end up dereferencing "state" a couple lines later. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c index 8df0aaf..867069b 100644 --- a/drivers/gpu/drm/a

[PATCH] udlfb: fix some inconsistent NULL checking

t can't be NULL so let's remove that check. Signed-off-by: Dan Carpenter diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c index 070026a7e55a..1d034dddc556 100644 --- a/drivers/video/fbdev/udlfb.c +++ b/drivers/video/fbdev/udlfb.c @@ -1598,7 +1598,7 @@ static

Re: [PATCH][drm-next] drm/vmwgfx: remove redundant return ret statement

ected by CoverityScan, CID#1473793 ("Structurally dead code") > Introduced by commit b139d43dacef ("drm/vmwgfx: Make buffer object lookups reference-free during validation"). The fix looks good. regards, dan carpenter ___ dri-devel

Re: [bug report] drm/sun4i: Handle DRM_BUS_FLAG_PIXDATA_*EDGE checking if panel is used.

On Tue, Oct 02, 2018 at 03:26:22PM +0200, Giulio Benetti wrote: > Il 01/10/2018 11:36, Dan Carpenter ha scritto: > > Hello Giulio Benetti, > > > > The patch 490cda5a3c82: "drm/sun4i: Handle DRM_BUS_FLAG_PIXDATA_*EDGE > > checking if panel is used." from

<    3   4   5   6   7   8   9   10   11   12   >