All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/i915/gem: Fix oops in error handling code
@ 2021-01-25  8:47 ` Dan Carpenter
  0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2021-01-25  8:47 UTC (permalink / raw)
  To: Jani Nikula
  Cc: David Airlie, intel-gfx, kernel-janitors, Gustavo A. R. Silva,
	Chris Wilson, Matthew Auld, Wambui Karuga

This code will Oops when it tries to i915_gem_object_free(obj) because
"obj" is an error pointer.

Fixes: 97d553963250 ("drm/i915/region: convert object_create into object_init")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/gpu/drm/i915/gem/i915_gem_stolen.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_stolen.c b/drivers/gpu/drm/i915/gem/i915_gem_stolen.c
index 551935348ad8..a1e197a6e999 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_stolen.c
@@ -753,22 +753,18 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_i915_private *i915,
 	mutex_lock(&i915->mm.stolen_lock);
 	ret = drm_mm_reserve_node(&i915->mm.stolen, stolen);
 	mutex_unlock(&i915->mm.stolen_lock);
-	if (ret) {
-		obj = ERR_PTR(ret);
+	if (ret)
 		goto err_free;
-	}
 
 	obj = i915_gem_object_alloc();
 	if (!obj) {
-		obj = ERR_PTR(-ENOMEM);
+		ret = -ENOMEM;
 		goto err_stolen;
 	}
 
 	ret = __i915_gem_object_create_stolen(mem, obj, stolen);
-	if (ret) {
-		obj = ERR_PTR(ret);
+	if (ret)
 		goto err_object_free;
-	}
 
 	i915_gem_object_set_cache_coherency(obj, I915_CACHE_NONE);
 	return obj;
@@ -779,7 +775,7 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_i915_private *i915,
 	i915_gem_stolen_remove_node(i915, stolen);
 err_free:
 	kfree(stolen);
-	return obj;
+	return ERR_PTR(ret);
 }
 
 bool i915_gem_object_is_stolen(const struct drm_i915_gem_object *obj)
-- 
2.29.2

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [Intel-gfx] [PATCH] drm/i915/gem: Fix oops in error handling code
@ 2021-01-25  8:47 ` Dan Carpenter
  0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2021-01-25  8:47 UTC (permalink / raw)
  To: Jani Nikula
  Cc: David Airlie, intel-gfx, kernel-janitors, Gustavo A. R. Silva,
	Chris Wilson, Matthew Auld, Wambui Karuga

This code will Oops when it tries to i915_gem_object_free(obj) because
"obj" is an error pointer.

Fixes: 97d553963250 ("drm/i915/region: convert object_create into object_init")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/gpu/drm/i915/gem/i915_gem_stolen.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_stolen.c b/drivers/gpu/drm/i915/gem/i915_gem_stolen.c
index 551935348ad8..a1e197a6e999 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_stolen.c
@@ -753,22 +753,18 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_i915_private *i915,
 	mutex_lock(&i915->mm.stolen_lock);
 	ret = drm_mm_reserve_node(&i915->mm.stolen, stolen);
 	mutex_unlock(&i915->mm.stolen_lock);
-	if (ret) {
-		obj = ERR_PTR(ret);
+	if (ret)
 		goto err_free;
-	}
 
 	obj = i915_gem_object_alloc();
 	if (!obj) {
-		obj = ERR_PTR(-ENOMEM);
+		ret = -ENOMEM;
 		goto err_stolen;
 	}
 
 	ret = __i915_gem_object_create_stolen(mem, obj, stolen);
-	if (ret) {
-		obj = ERR_PTR(ret);
+	if (ret)
 		goto err_object_free;
-	}
 
 	i915_gem_object_set_cache_coherency(obj, I915_CACHE_NONE);
 	return obj;
@@ -779,7 +775,7 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_i915_private *i915,
 	i915_gem_stolen_remove_node(i915, stolen);
 err_free:
 	kfree(stolen);
-	return obj;
+	return ERR_PTR(ret);
 }
 
 bool i915_gem_object_is_stolen(const struct drm_i915_gem_object *obj)
-- 
2.29.2

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/i915/gem: Fix oops in error handling code
  2021-01-25  8:47 ` [Intel-gfx] " Dan Carpenter
  (?)
@ 2021-01-25  9:41 ` Chris Wilson
  -1 siblings, 0 replies; 4+ messages in thread
From: Chris Wilson @ 2021-01-25  9:41 UTC (permalink / raw)
  To: Dan Carpenter, Jani Nikula
  Cc: David Airlie, intel-gfx, kernel-janitors, Gustavo A. R. Silva,
	Matthew Auld, Wambui Karuga

Quoting Dan Carpenter (2021-01-25 08:47:12)
> This code will Oops when it tries to i915_gem_object_free(obj) because
> "obj" is an error pointer.
> 
> Fixes: 97d553963250 ("drm/i915/region: convert object_create into object_init")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

It will indeed. On the preallocated path, so only during modprobe so
unlikely but also fatal bsod. It would also take brute force
selftest to generate the error, but as that doesn't serve any other
purpose, leave it to static analysis.

Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
-Chris
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply	[flat|nested] 4+ messages in thread
* [Intel-gfx] ✗ Fi.CI.BAT: failure for drm/i915/gem: Fix oops in error handling code
  2021-01-25  8:47 ` [Intel-gfx] " Dan Carpenter
  (?)
  (?)
@ 2021-01-25 13:09 ` Patchwork
  -1 siblings, 0 replies; 4+ messages in thread
From: Patchwork @ 2021-01-25 13:09 UTC (permalink / raw)
  To: Dan Carpenter; +Cc: intel-gfx


[-- Attachment #1.1: Type: text/plain, Size: 400 bytes --]

== Series Details ==

Series: drm/i915/gem: Fix oops in error handling code
URL   : https://patchwork.freedesktop.org/series/86249/
State : failure

== Summary ==

Applying: drm/i915/gem: Fix oops in error handling code
Using index info to reconstruct a base tree...
M	drivers/gpu/drm/i915/gem/i915_gem_stolen.c
Falling back to patching base and 3-way merge...
No changes -- Patch already applied.



[-- Attachment #1.2: Type: text/html, Size: 894 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-01-25 13:09 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-25  8:47 [PATCH] drm/i915/gem: Fix oops in error handling code Dan Carpenter
2021-01-25  8:47 ` [Intel-gfx] " Dan Carpenter
2021-01-25  9:41 ` Chris Wilson
2021-01-25 13:09 ` [Intel-gfx] ✗ Fi.CI.BAT: failure for " Patchwork

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.