Version: 5.19-rc5
In function 'via_do_init_map' (drivers/gpu/drm/via/via_map.c: 54)
'drm_legacy_findmap' can return NULL pointer. If that happens,it calls
'via_do_cleanup_map' (drivers/gpu/drm/via/via_map.c: 58).
---------------------------------------------------------------------
54 dev_priv->mmio = drm_legacy_findmap(dev, init->mmio_offset);
55 if (!dev_priv->mmio) {
56 DRM_ERROR("could not find mmio region!\n");
57 dev->dev_private = (void *)dev_priv;
58 via_do_cleanup_map(dev);
59 return -EINVAL;
60 }
---------------------------------------------------------------------
'via_do_cleanup' functions calls
'via_dma_cleanup'(drivers/gpu/drm/via/via_map.c: 78).
---------------------------------------------------------------------
76 int via_do_cleanup_map(struct drm_device *dev)
77 {
78 via_dma_cleanup(dev);
79
80 return 0;
81 }
---------------------------------------------------------------------
In 'via_dma_cleanup' there is another conditional construction
(drivers/gpu/drm/via/via_dma.c: 168).
---------------------------------------------------------------------
168 if (dev_priv->ring.virtual_start) {
169 via_cmdbuf_reset(dev_priv);
170
171 drm_legacy_ioremapfree(&dev_priv->ring.map, dev);
172 dev_priv->ring.virtual_start = NULL;
173 }
---------------------------------------------------------------------
It seems like there are two possible ways:
1) dev_priv->ring.virtual_start != 0.
In that case function call chain happens: 'via_cmdbuf_reset',
'via_cmdbuf_flush', 'via_hook_segment' and 'via_read'
(drivers/gpu/drm/via/via_drv.h: 124).
In 'via_read' dereferencing of "dev_priv->mmio" happens, which is NULL.
---------------------------------------------------------------------
124 static inline u32 via_read(struct drm_via_private *dev_priv, u32
reg)
125 {
126 return readl((void __iomem *)(dev_priv->mmio->handle +
reg));
127 }
---------------------------------------------------------------------
2) dev_priv->ring.virtual_start == 0.
Then all function calls located inside conditional construction
(drivers/gpu/drm/via/via_dma.c: 168) do not happen.
Thus, if dev_priv->mmio == NULL, call of 'via_do_cleanup_map'
(drivers/gpu/drm/via/via_map.c: 58) may result in either an error or
nothing at all.
Should we remove call to via_do_cleanup_map(dev) or should we somehow
avoid NULL pointer dereference in 'via_read'?
Found by Linux Verification Center (linuxtesting.org) with SVACE.
regards,
Rustam Subkhankulov
