adev->dm.dc is already checked in a few other if branches of the same
function so no reason not to check it everywhere else as well.
Moreover, admgpu_dm_fini() can be called from an error branch in
amdgpu_dm_init(), at which point it won't contain a valid dm.dc.
This might happen, for example, under OOM conditions.
Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.
Signed-off-by: Daniil Tatianin <d-tatianin@xxxxxxxxxxxxxx>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 589bee9acf16..6992bf766009 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1716,7 +1716,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
dc_deinit_callbacks(adev->dm.dc);
#endif
- dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
+ if (adev->dm.dc)
+ dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
if (dc_enable_dmub_notifications(adev->dm.dc)) {
kfree(adev->dm.dmub_notify);
@@ -1731,7 +1732,9 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
&adev->dm.dmub_bo_cpu_addr);
if (adev->dm.hpd_rx_offload_wq) {
- for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
+ int max_links = adev->dm.dc ? adev->dm.dc->caps.max_links : 0;
+
+ for (i = 0; i < max_links; i++) {
if (adev->dm.hpd_rx_offload_wq[i].wq) {
destroy_workqueue(adev->dm.hpd_rx_offload_wq[i].wq);
adev->dm.hpd_rx_offload_wq[i].wq = NULL;
--
2.25.1
