[PATCH 0/4] Fix issues reported by static code analysis tool

[PATCH 0/4] Fix issues reported by static code analysis tool

[Namrta Salonie]

The patchset is created to fix the issues static analysis tool has reported

Namrta Salonie (4):
  drm/i915: Fix for potential NULL pointer dereference at ctx access.
  drm/i915: Fix possible null dereference in two debugfs functions
  drm/i915 : Fix to remove unnecsessary checks in postclose function.
  drm/i915: Fix potential NULL pointer de-reference in ggtt unbind.

 drivers/gpu/drm/i915/i915_debugfs.c   |   19 +++++++++++++++----
 drivers/gpu/drm/i915/i915_dma.c       |    2 --
 drivers/gpu/drm/i915/i915_drv.h       |    5 ++++-
 drivers/gpu/drm/i915/i915_gpu_error.c |    2 +-
 4 files changed, 20 insertions(+), 8 deletions(-)

-- 
1.7.9.5

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH 1/4] drm/i915: Fix for potential NULL pointer dereference at ctx access.

[Namrta Salonie]

    Added a null check for the context pointer, before de-referencing it.
    Found by static analysis tool.

Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
---
 drivers/gpu/drm/i915/i915_gpu_error.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 2f04e4f..29ecd0c 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -1036,7 +1036,7 @@ static void i915_gem_record_rings(struct drm_device *dev,
 			 * for it to be useful (e.g. dump the context being
 			 * executed).
 			 */
-			if (request)
+			if (request && request->ctx)
 				rbuf = request->ctx->engine[ring->id].ringbuf;
 			else
 				rbuf = ring->default_context->engine[ring->id].ringbuf;
-- 
1.7.9.5

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH 2/4] drm/i915: Fix possible null dereference in two debugfs functions

[Namrta Salonie]

Found by static code analysis tool.

Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
Signed-off-by: Deepak S <deepak.s@intel.com>
---
 drivers/gpu/drm/i915/i915_debugfs.c |   19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index a3b22bd..d1719e9 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1873,6 +1873,9 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 
 	ifbdev = dev_priv->fbdev;
+	if (!ifbdev)
+		goto fb_loop;
+
 	fb = to_intel_framebuffer(ifbdev->helper.fb);
 
 	seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
@@ -1884,8 +1887,9 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
 		   atomic_read(&fb->base.refcount.refcount));
 	describe_obj(m, fb->obj);
 	seq_putc(m, '\n');
-#endif
 
+fb_loop:
+#endif
 	mutex_lock(&dev->mode_config.fb_lock);
 	drm_for_each_fb(drm_fb, dev) {
 		fb = to_intel_framebuffer(drm_fb);
@@ -3868,12 +3872,19 @@ static int pipe_crc_set_source(struct drm_device *dev, enum pipe pipe,
 			       enum intel_pipe_crc_source source)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
-	struct intel_pipe_crc *pipe_crc = &dev_priv->pipe_crc[pipe];
-	struct intel_crtc *crtc = to_intel_crtc(intel_get_crtc_for_pipe(dev,
-									pipe));
+	struct intel_pipe_crc *pipe_crc;
+	struct intel_crtc *crtc;
 	u32 val = 0; /* shut up gcc */
 	int ret;
 
+	if ((pipe < PIPE_A) || (pipe >= I915_MAX_PIPES))
+		return -EINVAL;
+
+	pipe_crc = &dev_priv->pipe_crc[pipe];
+
+	crtc = to_intel_crtc(intel_get_crtc_for_pipe(dev,
+                                                     pipe));
+
 	if (pipe_crc->source == source)
 		return 0;
 
-- 
1.7.9.5

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH 3/4] drm/i915 : Fix to remove unnecsessary checks in postclose function.

[Namrta Salonie]

    Found by static analysis tool.

Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
---
 drivers/gpu/drm/i915/i915_dma.c |    2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 2336af9..ac1bca6 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1269,8 +1269,6 @@ void i915_driver_postclose(struct drm_device *dev, struct drm_file *file)
 {
 	struct drm_i915_file_private *file_priv = file->driver_priv;
 
-	if (file_priv && file_priv->bsd_ring)
-		file_priv->bsd_ring = NULL;
 	kfree(file_priv);
 }
 
-- 
1.7.9.5

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH 4/4] drm/i915: Fix potential NULL pointer de-reference in ggtt unbind.

[Namrta Salonie]

    Found by static analysis tool.

Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
---
 drivers/gpu/drm/i915/i915_drv.h |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 8afda45..705b1e6 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -3097,7 +3097,10 @@ i915_gem_obj_ggtt_pin(struct drm_i915_gem_object *obj,
 static inline int
 i915_gem_object_ggtt_unbind(struct drm_i915_gem_object *obj)
 {
-	return i915_vma_unbind(i915_gem_obj_to_ggtt(obj));
+	struct i915_vma *vma = i915_gem_obj_to_ggtt(obj);
+	if (!vma)
+		return -EINVAL;
+	return i915_vma_unbind(vma);
 }
 
 void i915_gem_object_ggtt_unpin_view(struct drm_i915_gem_object *obj,
-- 
1.7.9.5

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 2/4] drm/i915: Fix possible null dereference in two debugfs functions

[Chris Wilson]

On Thu, Nov 19, 2015 at 04:57:29PM +0530, Namrta Salonie wrote:
> Found by static code analysis tool.
> 
> Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
> Signed-off-by: Deepak S <deepak.s@intel.com>
> ---
>  drivers/gpu/drm/i915/i915_debugfs.c |   19 +++++++++++++++----
>  1 file changed, 15 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
> index a3b22bd..d1719e9 100644
> --- a/drivers/gpu/drm/i915/i915_debugfs.c
> +++ b/drivers/gpu/drm/i915/i915_debugfs.c
> @@ -1873,6 +1873,9 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
>  	struct drm_i915_private *dev_priv = dev->dev_private;
>  
>  	ifbdev = dev_priv->fbdev;
> +	if (!ifbdev)

Just insert a block.

> @@ -3868,12 +3872,19 @@ static int pipe_crc_set_source(struct drm_device *dev, enum pipe pipe,
>  			       enum intel_pipe_crc_source source)
>  {
>  	struct drm_i915_private *dev_priv = dev->dev_private;
> -	struct intel_pipe_crc *pipe_crc = &dev_priv->pipe_crc[pipe];
> -	struct intel_crtc *crtc = to_intel_crtc(intel_get_crtc_for_pipe(dev,
> -									pipe));
> +	struct intel_pipe_crc *pipe_crc;
> +	struct intel_crtc *crtc;
>  	u32 val = 0; /* shut up gcc */
>  	int ret;
>  
> +	if ((pipe < PIPE_A) || (pipe >= I915_MAX_PIPES))
> +		return -EINVAL;

See display_crc_ctl_parse_pipe()
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 4/4] drm/i915: Fix potential NULL pointer de-reference in ggtt unbind.

[Chris Wilson]

On Thu, Nov 19, 2015 at 04:57:31PM +0530, Namrta Salonie wrote:
>     Found by static analysis tool.

What bug? Please fix any callsite where this is an issue, rather than
paper over the bug.
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 1/4] drm/i915: Fix for potential NULL pointer dereference at ctx access.

[Chris Wilson]

On Thu, Nov 19, 2015 at 04:57:28PM +0530, Namrta Salonie wrote:
>     Added a null check for the context pointer, before de-referencing it.
>     Found by static analysis tool.

False positive.
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH 3/4] drm/i915 : Fix to remove unnecsessary checks in postclose function.

[Daniel Vetter]

On Thu, Nov 19, 2015 at 04:57:30PM +0530, Namrta Salonie wrote:
>     Found by static analysis tool.
> 
> Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>

Queued for -next, thanks for the patch.
-Daniel

> ---
>  drivers/gpu/drm/i915/i915_dma.c |    2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
> index 2336af9..ac1bca6 100644
> --- a/drivers/gpu/drm/i915/i915_dma.c
> +++ b/drivers/gpu/drm/i915/i915_dma.c
> @@ -1269,8 +1269,6 @@ void i915_driver_postclose(struct drm_device *dev, struct drm_file *file)
>  {
>  	struct drm_i915_file_private *file_priv = file->driver_priv;
>  
> -	if (file_priv && file_priv->bsd_ring)
> -		file_priv->bsd_ring = NULL;
>  	kfree(file_priv);
>  }
>  
> -- 
> 1.7.9.5
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH] drm/i915: Fix possible null dereference in framebuffer_info debugfs function

[Namrta Salonie]

Found by static code analysis tool.

v2: Inserted block instead of goto & renamed variables (Chris)

Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
Signed-off-by: Deepak S <deepak.s@intel.com>
---
 drivers/gpu/drm/i915/i915_debugfs.c |   32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index a3b22bd..7c068ea 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1865,31 +1865,29 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
 {
 	struct drm_info_node *node = m->private;
 	struct drm_device *dev = node->minor->dev;
-	struct intel_fbdev *ifbdev = NULL;
-	struct intel_framebuffer *fb;
+	struct intel_framebuffer *fbdev_fb = NULL;
 	struct drm_framebuffer *drm_fb;
 
 #ifdef CONFIG_DRM_FBDEV_EMULATION
-	struct drm_i915_private *dev_priv = dev->dev_private;
 
-	ifbdev = dev_priv->fbdev;
-	fb = to_intel_framebuffer(ifbdev->helper.fb);
-
-	seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
-		   fb->base.width,
-		   fb->base.height,
-		   fb->base.depth,
-		   fb->base.bits_per_pixel,
-		   fb->base.modifier[0],
-		   atomic_read(&fb->base.refcount.refcount));
-	describe_obj(m, fb->obj);
-	seq_putc(m, '\n');
+	if (to_i915(dev)->fbdev) {
+		fbdev_fb = to_intel_framebuffer(to_i915(dev)->fbdev->helper.fb);
+		seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
+				fbdev_fb->base.width,
+				fbdev_fb->base.height,
+				fbdev_fb->base.depth,
+				fbdev_fb->base.bits_per_pixel,
+				fbdev_fb->base.modifier[0],
+				atomic_read(&fbdev_fb->base.refcount.refcount));
+		describe_obj(m, fbdev_fb->obj);
+		seq_putc(m, '\n');
+	}
 #endif
 
 	mutex_lock(&dev->mode_config.fb_lock);
 	drm_for_each_fb(drm_fb, dev) {
-		fb = to_intel_framebuffer(drm_fb);
-		if (ifbdev && &fb->base == ifbdev->helper.fb)
+		struct intel_framebuffer *fb = to_intel_framebuffer(drm_fb);
+		if (fb == fbdev_fb)
 			continue;
 
 		seq_printf(m, "user size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
-- 
1.7.9.5

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] drm/i915: Fix possible null dereference in framebuffer_info debugfs function

[Chris Wilson]

On Thu, Nov 26, 2015 at 04:32:30PM +0530, Namrta Salonie wrote:
> Found by static code analysis tool.
> 
> v2: Inserted block instead of goto & renamed variables (Chris)
> 
> Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
> Signed-off-by: Deepak S <deepak.s@intel.com>
> ---
>  drivers/gpu/drm/i915/i915_debugfs.c |   32 +++++++++++++++-----------------
>  1 file changed, 15 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
> index a3b22bd..7c068ea 100644
> --- a/drivers/gpu/drm/i915/i915_debugfs.c
> +++ b/drivers/gpu/drm/i915/i915_debugfs.c
> @@ -1865,31 +1865,29 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
>  {
>  	struct drm_info_node *node = m->private;
>  	struct drm_device *dev = node->minor->dev;
> -	struct intel_fbdev *ifbdev = NULL;
> -	struct intel_framebuffer *fb;
> +	struct intel_framebuffer *fbdev_fb = NULL;
>  	struct drm_framebuffer *drm_fb;
>  
>  #ifdef CONFIG_DRM_FBDEV_EMULATION
> -	struct drm_i915_private *dev_priv = dev->dev_private;
>  
> -	ifbdev = dev_priv->fbdev;
> -	fb = to_intel_framebuffer(ifbdev->helper.fb);
> -
> -	seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
> -		   fb->base.width,
> -		   fb->base.height,
> -		   fb->base.depth,
> -		   fb->base.bits_per_pixel,
> -		   fb->base.modifier[0],
> -		   atomic_read(&fb->base.refcount.refcount));
> -	describe_obj(m, fb->obj);
> -	seq_putc(m, '\n');
> +	if (to_i915(dev)->fbdev) {
> +		fbdev_fb = to_intel_framebuffer(to_i915(dev)->fbdev->helper.fb);
> +		seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
> +				fbdev_fb->base.width,
> +				fbdev_fb->base.height,
> +				fbdev_fb->base.depth,
> +				fbdev_fb->base.bits_per_pixel,
> +				fbdev_fb->base.modifier[0],
> +				atomic_read(&fbdev_fb->base.refcount.refcount));

These should be aligned to the opening '('

Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] drm/i915: Fix possible null dereference in framebuffer_info debugfs function

[Daniel Vetter]

On Thu, Nov 26, 2015 at 12:43:19PM +0000, Chris Wilson wrote:
> On Thu, Nov 26, 2015 at 04:32:30PM +0530, Namrta Salonie wrote:
> > Found by static code analysis tool.
> > 
> > v2: Inserted block instead of goto & renamed variables (Chris)
> > 
> > Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
> > Signed-off-by: Deepak S <deepak.s@intel.com>
> > ---
> >  drivers/gpu/drm/i915/i915_debugfs.c |   32 +++++++++++++++-----------------
> >  1 file changed, 15 insertions(+), 17 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
> > index a3b22bd..7c068ea 100644
> > --- a/drivers/gpu/drm/i915/i915_debugfs.c
> > +++ b/drivers/gpu/drm/i915/i915_debugfs.c
> > @@ -1865,31 +1865,29 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
> >  {
> >  	struct drm_info_node *node = m->private;
> >  	struct drm_device *dev = node->minor->dev;
> > -	struct intel_fbdev *ifbdev = NULL;
> > -	struct intel_framebuffer *fb;
> > +	struct intel_framebuffer *fbdev_fb = NULL;
> >  	struct drm_framebuffer *drm_fb;
> >  
> >  #ifdef CONFIG_DRM_FBDEV_EMULATION
> > -	struct drm_i915_private *dev_priv = dev->dev_private;
> >  
> > -	ifbdev = dev_priv->fbdev;
> > -	fb = to_intel_framebuffer(ifbdev->helper.fb);
> > -
> > -	seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
> > -		   fb->base.width,
> > -		   fb->base.height,
> > -		   fb->base.depth,
> > -		   fb->base.bits_per_pixel,
> > -		   fb->base.modifier[0],
> > -		   atomic_read(&fb->base.refcount.refcount));
> > -	describe_obj(m, fb->obj);
> > -	seq_putc(m, '\n');
> > +	if (to_i915(dev)->fbdev) {
> > +		fbdev_fb = to_intel_framebuffer(to_i915(dev)->fbdev->helper.fb);
> > +		seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
> > +				fbdev_fb->base.width,
> > +				fbdev_fb->base.height,
> > +				fbdev_fb->base.depth,
> > +				fbdev_fb->base.bits_per_pixel,
> > +				fbdev_fb->base.modifier[0],
> > +				atomic_read(&fbdev_fb->base.refcount.refcount));
> 
> These should be aligned to the opening '('

Patch also doesn't apply cleanly any more on top of drm-intel-nightly. Can
you please rebase and fix up the alignment problem Chris pointed out
above?

Thanks, Daniel

> 
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> -Chris
> 
> -- 
> Chris Wilson, Intel Open Source Technology Centre
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

[PATCH] drm/i915: Fix possible null dereference in framebuffer_info debugfs function

[Namrta Salonie]

Found by static code analysis tool.

v2: Inserted block instead of goto & renamed variables (Chris)
v3: Aligned code as per the opening brace (Chris)
    Rebased on top of nightly (Daniel)

Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
Signed-off-by: Deepak S <deepak.s@intel.com>
---
 drivers/gpu/drm/i915/i915_debugfs.c |   36 ++++++++++++++++-------------------
 1 file changed, 16 insertions(+), 20 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index a728ff1..bfd57fb 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1869,33 +1869,29 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
 {
 	struct drm_info_node *node = m->private;
 	struct drm_device *dev = node->minor->dev;
-	struct intel_fbdev *ifbdev = NULL;
-	struct intel_framebuffer *fb;
+	struct intel_framebuffer *fbdev_fb = NULL;
 	struct drm_framebuffer *drm_fb;
 
 #ifdef CONFIG_DRM_FBDEV_EMULATION
-	struct drm_i915_private *dev_priv = dev->dev_private;
-
-	ifbdev = dev_priv->fbdev;
-	if (ifbdev) {
-		fb = to_intel_framebuffer(ifbdev->helper.fb);
-
-		seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
-			   fb->base.width,
-			   fb->base.height,
-			   fb->base.depth,
-			   fb->base.bits_per_pixel,
-			   fb->base.modifier[0],
-			   atomic_read(&fb->base.refcount.refcount));
-		describe_obj(m, fb->obj);
-		seq_putc(m, '\n');
-	}
+       if (to_i915(dev)->fbdev) {
+               fbdev_fb = to_intel_framebuffer(to_i915(dev)->fbdev->helper.fb);
+
+               seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
+                         fbdev_fb->base.width,
+                         fbdev_fb->base.height,
+                         fbdev_fb->base.depth,
+                         fbdev_fb->base.bits_per_pixel,
+                         fbdev_fb->base.modifier[0],
+                         atomic_read(&fbdev_fb->base.refcount.refcount));
+               describe_obj(m, fbdev_fb->obj);
+               seq_putc(m, '\n');
+       }
 #endif
 
 	mutex_lock(&dev->mode_config.fb_lock);
 	drm_for_each_fb(drm_fb, dev) {
-		fb = to_intel_framebuffer(drm_fb);
-		if (ifbdev && &fb->base == ifbdev->helper.fb)
+		struct intel_framebuffer *fb = to_intel_framebuffer(drm_fb);
+		if (fb == fbdev_fb)
 			continue;
 
 		seq_printf(m, "user size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
-- 
1.7.9.5

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] drm/i915: Fix possible null dereference in framebuffer_info debugfs function

[Daniel Vetter]

On Fri, Nov 27, 2015 at 01:43:11PM +0530, Namrta Salonie wrote:
> Found by static code analysis tool.
> 
> v2: Inserted block instead of goto & renamed variables (Chris)
> v3: Aligned code as per the opening brace (Chris)
>     Rebased on top of nightly (Daniel)
> 
> Signed-off-by: Namrta Salonie <namrta.salonie@intel.com>
> Signed-off-by: Deepak S <deepak.s@intel.com>

Queued for -next, thanks for the patch.
-Daniel

> ---
>  drivers/gpu/drm/i915/i915_debugfs.c |   36 ++++++++++++++++-------------------
>  1 file changed, 16 insertions(+), 20 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
> index a728ff1..bfd57fb 100644
> --- a/drivers/gpu/drm/i915/i915_debugfs.c
> +++ b/drivers/gpu/drm/i915/i915_debugfs.c
> @@ -1869,33 +1869,29 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
>  {
>  	struct drm_info_node *node = m->private;
>  	struct drm_device *dev = node->minor->dev;
> -	struct intel_fbdev *ifbdev = NULL;
> -	struct intel_framebuffer *fb;
> +	struct intel_framebuffer *fbdev_fb = NULL;
>  	struct drm_framebuffer *drm_fb;
>  
>  #ifdef CONFIG_DRM_FBDEV_EMULATION
> -	struct drm_i915_private *dev_priv = dev->dev_private;
> -
> -	ifbdev = dev_priv->fbdev;
> -	if (ifbdev) {
> -		fb = to_intel_framebuffer(ifbdev->helper.fb);
> -
> -		seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
> -			   fb->base.width,
> -			   fb->base.height,
> -			   fb->base.depth,
> -			   fb->base.bits_per_pixel,
> -			   fb->base.modifier[0],
> -			   atomic_read(&fb->base.refcount.refcount));
> -		describe_obj(m, fb->obj);
> -		seq_putc(m, '\n');
> -	}
> +       if (to_i915(dev)->fbdev) {
> +               fbdev_fb = to_intel_framebuffer(to_i915(dev)->fbdev->helper.fb);
> +
> +               seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
> +                         fbdev_fb->base.width,
> +                         fbdev_fb->base.height,
> +                         fbdev_fb->base.depth,
> +                         fbdev_fb->base.bits_per_pixel,
> +                         fbdev_fb->base.modifier[0],
> +                         atomic_read(&fbdev_fb->base.refcount.refcount));
> +               describe_obj(m, fbdev_fb->obj);
> +               seq_putc(m, '\n');
> +       }
>  #endif
>  
>  	mutex_lock(&dev->mode_config.fb_lock);
>  	drm_for_each_fb(drm_fb, dev) {
> -		fb = to_intel_framebuffer(drm_fb);
> -		if (ifbdev && &fb->base == ifbdev->helper.fb)
> +		struct intel_framebuffer *fb = to_intel_framebuffer(drm_fb);
> +		if (fb == fbdev_fb)
>  			continue;
>  
>  		seq_printf(m, "user size: %d x %d, depth %d, %d bpp, modifier 0x%llx, refcount %d, obj ",
> -- 
> 1.7.9.5
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx