[PATCH] drm/etnaviv: Added error handling for dma_map_sgtable.

[Danila Chernetsov]

Added error handling for dma_map_sgtable.
If an error occurs, the sgt table is freed.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 182354a526a0 ("drm: etnaviv: fix common struct sg_table related issues")
Signed-off-by: Danila Chernetsov 
---
 drivers/gpu/drm/etnaviv/etnaviv_gem.c | 14 +++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c 
b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index b5f73502e3dd..59d1684dafc4 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -17,7 +17,7 @@
 static struct lock_class_key etnaviv_shm_lock_class;
 static struct lock_class_key etnaviv_userptr_lock_class;
 
-static void etnaviv_gem_scatter_map(struct etnaviv_gem_object *etnaviv_obj)
+static int etnaviv_gem_scatter_map(struct etnaviv_gem_object *etnaviv_obj)
 {
struct drm_device *dev = etnaviv_obj->base.dev;
struct sg_table *sgt = etnaviv_obj->sgt;
@@ -27,7 +27,9 @@ static void etnaviv_gem_scatter_map(struct etnaviv_gem_object 
*etnaviv_obj)
 * because display controller, GPU, etc. are not coherent.
 */
if (etnaviv_obj->flags & ETNA_BO_CACHE_MASK)
-   dma_map_sgtable(dev->dev, sgt, DMA_BIDIRECTIONAL, 0);
+   return dma_map_sgtable(dev->dev, sgt, DMA_BIDIRECTIONAL, 0);
+
+   return 0;
 }
 
 static void etnaviv_gem_scatterlist_unmap(struct etnaviv_gem_object 
*etnaviv_obj)
@@ -113,7 +115,13 @@ struct page **etnaviv_gem_get_pages(struct 
etnaviv_gem_object *etnaviv_obj)
 
etnaviv_obj->sgt = sgt;
 
-   etnaviv_gem_scatter_map(etnaviv_obj);
+   ret = etnaviv_gem_scatter_map(etnaviv_obj);
+   if (ret < 0) {
+   sg_free_table(etnaviv_obj->sgt);
+   kfree(etnaviv_obj->sgt);
+   etnaviv_obj->sgt = NULL;
+   return ERR_PTR(ret);
+   }
}
 
return etnaviv_obj->pages;
-- 
2.25.1

[PATCH v5.10 1/1] drm/amdgpu: add error handling for drm_fb_helper_initial_config

[Danila Chernetsov]

The type of return value of drm_fb_helper_initial_config is int, 
which may return wrong result, so we add error handling for it 
to reclaim memory resource, and return when an error occurs.  

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d38ceaf99ed0 (drm/amdgpu: add core driver (v4))
Signed-off-by: Danila Chernetsov 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 13 +++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
index 43f29ee0e3b0..e445a2c9f569 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
@@ -348,8 +348,17 @@ int amdgpu_fbdev_init(struct amdgpu_device *adev)
if (!amdgpu_device_has_dc_support(adev))
drm_helper_disable_unused_functions(adev_to_drm(adev));
 
-   drm_fb_helper_initial_config(>helper, bpp_sel);
-   return 0;
+   ret = drm_fb_helper_initial_config(>helper, bpp_sel);
+   if (ret)
+   goto fini;
+
+   return 0;
+
+fini:
+   drm_fb_helper_fini(>helper);
+
+   kfree(rfbdev);
+   return ret;
 }
 
 void amdgpu_fbdev_fini(struct amdgpu_device *adev)
-- 
2.25.1

[no subject]

[Danila Chernetsov]

Date: Sat, 11 Mar 2023 19:00:03 +
Subject: [PATCH 5.10 1/1] drm/amdgpu: add error handling for 
drm_fb_helper_initial_config

The type of return value of drm_fb_helper_initial_config is int, which may 
return wrong result, so we add error handling for it to reclaim memory resource,
and return when an error occurs.   

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d38ceaf99ed0 (drm/amdgpu: add core driver (v4))
Signed-off-by: Danila Chernetsov 
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 13 +++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
index 43f29ee0e3b0..e445a2c9f569 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
@@ -348,8 +348,17 @@ int amdgpu_fbdev_init(struct amdgpu_device *adev)
if (!amdgpu_device_has_dc_support(adev))
drm_helper_disable_unused_functions(adev_to_drm(adev));
 
-   drm_fb_helper_initial_config(>helper, bpp_sel);
-   return 0;
+   ret = drm_fb_helper_initial_config(>helper, bpp_sel);
+   if (ret)
+   goto fini;
+
+   return 0;
+
+fini:
+   drm_fb_helper_fini(>helper);
+
+   kfree(rfbdev);
+   return ret;
 }
 
 void amdgpu_fbdev_fini(struct amdgpu_device *adev)
-- 
2.25.1

[PATCH] drm/amd/display: remove an unnecessary NULL check

[Danila Chernetsov]

The 'pipe' can't be NULL because it points to an element of array.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixed: 7cf2c840c6b5 (drm/amd/display: Commit validation set from state)
Signed-off-by: Danila Chernetsov 
---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c 
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 0cb8d1f934d1..d3b850372eb3 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1854,7 +1854,7 @@ static enum dc_status dc_commit_state_no_check(struct dc 
*dc, struct dc_state *c
for (k = 0; k < MAX_PIPES; k++) {
pipe = >res_ctx.pipe_ctx[k];
 
-   for (l = 0 ; pipe && l < context->stream_count; l++)  {
+   for (l = 0 ; l < context->stream_count; l++)  {
if (context->streams[l] &&
context->streams[l] == pipe->stream &&
dc->hwss.setup_stereo)
-- 
2.25.1