[PATCH 2/5] drm/amd/display: Move three variable assignments behind condition checks in trigger_hotplug()

[Markus Elfring]

Date: Tue, 11 Apr 2023 11:39:02 +0200

The address of a data structure member was determined before
a corresponding null pointer check in the implementation of
the function “trigger_hotplug”.

Thus avoid the risk for undefined behaviour by moving the assignment
for three local variables behind some condition checks.

This issue was detected by using the Coccinelle software.

Fixes: 6f77b2ac628073f647041a92b36c824ae3aef16e ("drm/amd/display: Add 
connector HPD trigger debugfs entry")
Signed-off-by: Markus Elfring <elfr...@users.sourceforge.net>
---
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 827fcb4fb3b3..b3cfd7dfbb28 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -1205,10 +1205,10 @@ static ssize_t trigger_hotplug(struct file *f, const 
char __user *buf,
                                                        size_t size, loff_t 
*pos)
 {
        struct amdgpu_dm_connector *aconnector = file_inode(f)->i_private;
-       struct drm_connector *connector = &aconnector->base;
+       struct drm_connector *connector;
        struct dc_link *link = NULL;
-       struct drm_device *dev = connector->dev;
-       struct amdgpu_device *adev = drm_to_adev(dev);
+       struct drm_device *dev;
+       struct amdgpu_device *adev;
        enum dc_connection_type new_connection_type = dc_connection_none;
        char *wr_buf = NULL;
        uint32_t wr_buf_size = 42;
@@ -1253,12 +1253,16 @@ static ssize_t trigger_hotplug(struct file *f, const 
char __user *buf,
                return -EINVAL;
        }

+       connector = &aconnector->base;
+       dev = connector->dev;
+
        if (param[0] == 1) {

                if (!dc_link_detect_connection_type(aconnector->dc_link, 
&new_connection_type) &&
                        new_connection_type != dc_connection_none)
                        goto unlock;

+               adev = drm_to_adev(dev);
                mutex_lock(&adev->dm.dc_lock);
                ret = dc_link_detect(aconnector->dc_link, DETECT_REASON_HPD);
                mutex_unlock(&adev->dm.dc_lock);
--
2.40.0