Re: [bug report] drm/msm: Add SDM845 DPU support

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hey Dan,

Thanks for the heads up, will take care of it.

On 2021-10-01 05:28, Dan Carpenter wrote:
Hello Jeykumar Sankaran,

The patch 25fdd5933e4c: "drm/msm: Add SDM845 DPU support" from Jun
27, 2018, leads to the following
Smatch static checker warning:

	drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1679 dpu_plane_init()
	warn: '&pdpu->mplane_list' not removed from list

drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
    1567 struct drm_plane *dpu_plane_init(struct drm_device *dev,
    1568                 uint32_t pipe, enum drm_plane_type type,
1569 unsigned long possible_crtcs, u32 master_plane_id)
    1570 {
    1571         struct drm_plane *plane = NULL, *master_plane = NULL;
    1572         const uint32_t *format_list;
    1573         struct dpu_plane *pdpu;
    1574         struct msm_drm_private *priv = dev->dev_private;
    1575         struct dpu_kms *kms = to_dpu_kms(priv->kms);
    1576         int zpos_max = DPU_ZPOS_MAX;
    1577         uint32_t num_formats;
    1578         int ret = -EINVAL;
    1579
    1580         /* create and zero local structure */
    1581         pdpu = kzalloc(sizeof(*pdpu), GFP_KERNEL);
    1582         if (!pdpu) {
    1583                 DPU_ERROR("[%u]failed to allocate local plane
struct\n", pipe);
    1584                 ret = -ENOMEM;
    1585                 return ERR_PTR(ret);
    1586         }
    1587
    1588         /* cache local stuff for later */
    1589         plane = &pdpu->base;
    1590         pdpu->pipe = pipe;
    1591         pdpu->is_virtual = (master_plane_id != 0);
    1592         INIT_LIST_HEAD(&pdpu->mplane_list);
1593 master_plane = drm_plane_find(dev, NULL, master_plane_id);
    1594         if (master_plane) {
1595 struct dpu_plane *mpdpu = to_dpu_plane(master_plane);
    1596
1597 list_add_tail(&pdpu->mplane_list, &mpdpu->mplane_list);
                                        ^^^^^^^^^^^^^^^^^
This is not removed from the list in the error handling code so it will
lead to a Use After Free.

    1598         }
    1599
    1600         /* initialize underlying h/w driver */
1601 pdpu->pipe_hw = dpu_hw_sspp_init(pipe, kms->mmio, kms->catalog,
    1602
master_plane_id != 0);
    1603         if (IS_ERR(pdpu->pipe_hw)) {
    1604                 DPU_ERROR("[%u]SSPP init failed\n", pipe);
    1605                 ret = PTR_ERR(pdpu->pipe_hw);
    1606                 goto clean_plane;
1607 } else if (!pdpu->pipe_hw->cap || !pdpu->pipe_hw->cap->sblk) {
    1608                 DPU_ERROR("[%u]SSPP init returned invalid
cfg\n", pipe);
    1609                 goto clean_sspp;
    1610         }
    1611
    1612         /* cache features mask for later */
    1613         pdpu->features = pdpu->pipe_hw->cap->features;
    1614         pdpu->pipe_sblk = pdpu->pipe_hw->cap->sblk;
    1615         if (!pdpu->pipe_sblk) {
    1616                 DPU_ERROR("[%u]invalid sblk\n", pipe);
    1617                 goto clean_sspp;
    1618         }
    1619
    1620         if (pdpu->is_virtual) {
1621 format_list = pdpu->pipe_sblk->virt_format_list; 1622 num_formats = pdpu->pipe_sblk->virt_num_formats;
    1623         }
    1624         else {
    1625                 format_list = pdpu->pipe_sblk->format_list;
    1626                 num_formats = pdpu->pipe_sblk->num_formats;
    1627         }
    1628
    1629         ret = drm_universal_plane_init(dev, plane, 0xff,
&dpu_plane_funcs,
    1630                                 format_list, num_formats,
    1631                                 supported_format_modifiers,
type, NULL);
    1632         if (ret)
    1633                 goto clean_sspp;
    1634
    1635         pdpu->catalog = kms->catalog;
    1636
    1637         if (kms->catalog->mixer_count &&
    1638                 kms->catalog->mixer[0].sblk->maxblendstages) {
    1639                 zpos_max =
kms->catalog->mixer[0].sblk->maxblendstages - 1;
1640 if (zpos_max > DPU_STAGE_MAX - DPU_STAGE_0 - 1) 1641 zpos_max = DPU_STAGE_MAX - DPU_STAGE_0 - 1;
    1642         }
    1643
1644 ret = drm_plane_create_zpos_property(plane, 0, 0, zpos_max);
    1645         if (ret)
    1646                 DPU_ERROR("failed to install zpos property,
rc = %d\n", ret);
    1647
    1648         drm_plane_create_alpha_property(plane);
    1649         drm_plane_create_blend_mode_property(plane,
    1650                         BIT(DRM_MODE_BLEND_PIXEL_NONE) |
    1651                         BIT(DRM_MODE_BLEND_PREMULTI) |
    1652                         BIT(DRM_MODE_BLEND_COVERAGE));
    1653
    1654         drm_plane_create_rotation_property(plane,
    1655                         DRM_MODE_ROTATE_0,
    1656                         DRM_MODE_ROTATE_0 |
    1657                         DRM_MODE_ROTATE_180 |
    1658                         DRM_MODE_REFLECT_X |
    1659                         DRM_MODE_REFLECT_Y);
    1660
    1661         drm_plane_enable_fb_damage_clips(plane);
    1662
    1663         /* success! finalize initialization */
    1664         drm_plane_helper_add(plane, &dpu_plane_helper_funcs);
    1665
    1666         /* save user friendly pipe name for later */
    1667         snprintf(pdpu->pipe_name, DPU_NAME_SIZE, "plane%u",
plane->base.id);
    1668
    1669         mutex_init(&pdpu->lock);
    1670
    1671         DPU_DEBUG("%s created for pipe:%u id:%u
virtual:%u\n", pdpu->pipe_name,
    1672                                         pipe, plane->base.id,
master_plane_id);
    1673         return plane;
    1674
    1675 clean_sspp:
    1676         if (pdpu && pdpu->pipe_hw)
    1677                 dpu_hw_sspp_destroy(pdpu->pipe_hw);
    1678 clean_plane:
--> 1679         kfree(pdpu);
    1680         return ERR_PTR(ret);
    1681 }

regards,
dan carpenter

Best,
Jessica Zhang



[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux