If get_user_pages_fast() allocates some pages but not as many as we
wanted, then the current code leaks those pages. Call put_page() on
the pages before returning.
Fixes: 129776ac2e38 ("accel/qaic: Add control path")
Signed-off-by: Dan Carpenter
---
no change
drivers/accel/qaic/qaic
Move the check to find_and_map_user_pages() instead and add some more
additional potential integer overflow checks.
Fixes: 129776ac2e38 ("accel/qaic: Add control path")
Signed-off-by: Dan Carpenter
---
no change
drivers/accel/qaic/qaic_control.c | 9 ++---
1 file changed, 6 i
.
Fixes: 129776ac2e38 ("accel/qaic: Add control path")
Signed-off-by: Dan Carpenter
---
v2: no change
drivers/accel/qaic/qaic_control.c | 14 ++
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/accel/qaic/qaic_control.c
b/drivers/accel/qaic/qaic_contr
't corrupt memory in
decode_passthrough() when we do.
memcpy(out_trans->data, in_trans->data, len - sizeof(in_trans->hdr));
And finally, use size_add() to prevent an integer overflow:
if (size_add(msg_len, hdr_len) > msg_hdr_len)
Fixes: 129776ac2e38 ("accel/q
al concern is that the "user_len + trans_hdr->len" might have an
integer overflow bug. Use size_add() to prevent that.
- if (user_len + trans_hdr->len > user_msg->len) {
+ if (size_add(user_len, trans_hdr->len) > user_msg->len) {
Fixes: 129776ac2e38 (&quo
Fixed in v4: Send the correct [PATCH 1/5] patch.
Fixed in v3: Redo messed up threading
Fixed two things in v2: Include the file. Change
the >= in encode and decode to >.
regards,
dan carpenter
NAK.
Wow. I really screwed this up. I didn't mean to send this patch. I
have a correct patch still sitting in my postponed messages.
I will send v4 in twenty minutes.
regards,
dan carpenter
Negative -EINVAL was intended instead of positive EINVAL.
Fixes: 6a23afad443a ("phy: phy-mtk-dp: Add driver for DP phy")
Signed-off-by: Dan Carpenter
---
drivers/phy/mediatek/phy-mtk-dp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/phy/mediatek/phy-m
If get_user_pages_fast() allocates some pages but not as many as we
wanted, then the current code leaks those pages. Call put_page() on
the pages before returning.
Fixes: 129776ac2e38 ("accel/qaic: Add control path")
Signed-off-by: Dan Carpenter
---
no change
drivers/accel/qaic/qaic
Move the check to find_and_map_user_pages() instead and add some more
additional potential integer overflow checks.
Fixes: 129776ac2e38 ("accel/qaic: Add control path")
Signed-off-by: Dan Carpenter
---
no change
drivers/accel/qaic/qaic_control.c | 9 ++---
1 file changed, 6 i
.
Fixes: 129776ac2e38 ("accel/qaic: Add control path")
Signed-off-by: Dan Carpenter
---
v2: no change
drivers/accel/qaic/qaic_control.c | 14 ++
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/accel/qaic/qaic_control.c
b/drivers/accel/qaic/qaic_contr
't corrupt memory in
decode_passthrough() when we do.
memcpy(out_trans->data, in_trans->data, len - sizeof(in_trans->hdr));
And finally, use size_add() to prevent an integer overflow:
if (size_add(msg_len, hdr_len) > msg_hdr_len)
Fixes: 129776ac2e38 ("accel/q
al concern is that the "user_len + trans_hdr->len" might have an
integer overflow bug. Use size_add() to prevent that.
- if (user_len + trans_hdr->len > user_msg->len) {
+ if (size_add(user_len, trans_hdr->len) > user_msg->len) {
Fixes: 129776ac2e38 (&quo
Fixed in v3: Redo messed up threading
Fixed two things in v2: Include the file. Change
the >= in encode and decode to >.
regards,
dan carpenter
Oops. Left the v2 out of the subject.
Let me start this whole thread over...
regards,
dan carpenter
al concern is that the "user_len + trans_hdr->len" might have an
integer overflow bug. Use size_add() to prevent that.
- if (user_len + trans_hdr->len > user_msg->len) {
+ if (size_add(user_len, trans_hdr->len) > user_msg->len) {
Fixes: 129776ac2e38 (&quo
Fixed two things in v2: Include the file. Change
the >= in encode and decode to >.
regards,
dan carpenter
ated emails from the kbuild (zero day) bot. I just look
them over and hit forward.
regards,
dan carpenter
patch/commit), kindly add following tags
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
| Closes: https://lore.kernel.org/r/202307100423.rv7d05uq-...@intel.com/
smatch warnings:
drivers/gpu/drm/loongson/lsdc_plane.c:199
lsdc_cursor_plane_atomic_async_check() warn: variable
On Thu, Jul 06, 2023 at 08:21:35AM +0200, Christian König wrote:
> Am 06.07.23 um 07:52 schrieb Dan Carpenter:
> > The __dma_fence_unwrap_merge() function is supposed to return NULL on
> > error. But the dma_fence_allocate_private_stub() returns error pointers
> > so check fo
e expected NULL pointers. Change
it to return NULL and update the caller which expected error pointers,
drm_syncobj_assign_null_handle(), to check for NULL instead.
Fixes: f781f661e8c9 ("dma-buf: keep the signaling time of merged fences v3")
Signed-off-by: Dan Carpente
: f781f661e8c9 ("dma-buf: keep the signaling time of merged fences v3")
Signed-off-by: Dan Carpenter
---
drivers/dma-buf/dma-fence-unwrap.c | 10 --
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/dma-buf/dma-fence-unwrap.c
b/drivers/dma-buf/dma-fence-unwr
On Tue, Jul 04, 2023 at 03:18:26PM +0530, Pranjal Ramajor Asha Kanojiya wrote:
>
>
> On 7/4/2023 2:08 PM, Dan Carpenter wrote:
> > On Tue, Jul 04, 2023 at 11:57:51AM +0530, Pranjal Ramajor Asha Kanojiya
> > wrote:
> > > > diff --git a/drivers/accel/qaic/qaic_c
;) Those are two separate conditions so I put them on
two lines. If it were something very related like if (x < 0 || x >= 10)
then I would have put it on one line.
regards,
dan carpenter
break;
> > }
> > trans_hdr = (struct qaic_manage_trans_hdr *)(user_msg->data +
> > user_len);
> > - if (user_len + trans_hdr->len > user_msg->len) {
> > + if (trans_hdr->len < sizeof(trans_hdr) ||
> > + size_add(user_len, trans_hdr->len) > user_msg->len) {
If we change to > then the == will be caught by this check. So it
doesn't affect runtime either way.
regards,
dan carpenter
user doesn't
> know that a truncation has happened. So that if we save from an
> overflow here, we might encur to an unwanted access later when we
> would start using the array for the size we think is allocated.
SIZE_MAX allocations are guaranteed to fail, so the NULL check
will still return -ENOMEM.
>
> kmalloc_array(), for example, returns NULL of there is a
> multiplication overflow and I think that's a better behaviour,
> although more drastic.
It's the same either way.
regards,
dan carpenter
On Thu, Jun 22, 2023 at 02:43:57PM +0300, Dan Carpenter wrote:
> > > - if (!user_msg->count) {
> > > + if (!user_msg->count ||
> > > + user_msg->len < sizeof(*trans_hdr)) {
> > Can we have something like this here
> > user_msg->len <
On Thu, Jun 22, 2023 at 04:54:03PM +0530, Pranjal Ramajor Asha Kanojiya wrote:
>
>
> On 6/21/2023 12:51 PM, Dan Carpenter wrote:
> > There are several issues in this code. The check at the start of the
> > loop:
> >
> > if (user_len >= user_msg->len
On Wed, Jun 21, 2023 at 08:53:41PM -0600, Jeffrey Hugo wrote:
> On 6/21/2023 1:21 AM, Dan Carpenter wrote:
> > (I think this is the first cover letter I have ever written).
> >
> > These patches are based on review and not from testing.
>
> Thank you for your review.
If get_user_pages_fast() allocates some pages but not as many as we
wanted, then the current code leaks those pages. Call put_page() on
the pages before returning.
Fixes: 129776ac2e38 ("accel/qaic: Add control path")
Signed-off-by: Dan Carpenter
---
drivers/accel/qaic/qaic_con
Move the check to find_and_map_user_pages() instead and add some more
additional potential integer overflow checks.
Fixes: 129776ac2e38 ("accel/qaic: Add control path")
Signed-off-by: Dan Carpenter
---
I kind of went to town adding integer overflow checks here. Please,
review this
.
Fixes: 129776ac2e38 ("accel/qaic: Add control path")
Signed-off-by: Dan Carpenter
---
drivers/accel/qaic/qaic_control.c | 14 ++
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/accel/qaic/qaic_control.c
b/drivers/accel/qaic/qaic_control.c
index 78
't corrupt memory in
decode_passthrough() when we do.
memcpy(out_trans->data, in_trans->data, len - sizeof(in_trans->hdr));
And finally, use size_add() to prevent an integer overflow:
if (size_add(msg_len, hdr_len) > msg_hdr_len)
Fixes: 129776ac2e38 ("accel/q
al concern is that the "user_len + trans_hdr->len" might have an
integer overflow bug. Use size_add() to prevent that.
- if (user_len + trans_hdr->len > user_msg->len) {
+ if (size_add(user_len, trans_hdr->len) > user_msg->len) {
Fixes: 129776ac2e38 (&quo
which indicates deep distrust.
What I'm saying is that there may be more issues in this code. But also
that I don't really understand it so please review carefully.
The patch that I'm least sure of is 4/5:
[PATCH 4/5] accel/qaic: move and expand integer overflow checks for
map_user_pages()
regards,
dan carpenter
return r;
Smatch complains that we don't necessarily enter the loop. I think
I'm going to disable this type of "enter the loop" warning when you
don't have the cross function database available. That will silence
these for the kbuild bot.
regards,
dan carpenter
Hi
On Tue, Jun 20, 2023 at 10:37:59AM +0300, Dan Carpenter wrote:
> "Mark the associated types properly packed individually, rather than
> use the disgusting "pragma pack()" that should never be used."
>
> https://lore.kernel.org/linux-sparse/CAHk-=wi7jgz+bvb
"Mark the associated types properly packed individually, rather than
use the disgusting "pragma pack()" that should never be used."
https://lore.kernel.org/linux-sparse/CAHk-=wi7jgz+bvbt-ufxokpeqdhzf3z2hbjkgdjh8q4dvpp...@mail.gmail.com/
regards,
dan carpenter
The "video_size_step" variable is never used so it can be removed.
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/sprd/sprd_dsi.c | 6 ++
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/sprd/sprd_dsi.c b/drivers/gpu/drm/sprd/sprd_dsi.c
index ab
or a long time without
seeing the fix. Then I misunderstood Sam's review comments (my fault,
they were clear in retrospect) so I got completely lost.
regards,
dan carpenter
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
| Closes: https://lore.kernel.org/r/202306101458.lrxhee0z-...@intel.com/
smatch warnings:
drivers/gpu/drm/mediatek/mtk_disp_gamma.c:192 mtk_gamma_set_common() error: we
previously assumed 'gamma->data' could be null (see line 1
On Thu, Jun 08, 2023 at 02:26:14AM +0300, Dmitry Baryshkov wrote:
> On 07/06/2023 17:42, Dan Carpenter wrote:
> > On Tue, Jun 06, 2023 at 10:23:46PM +0200, Marijn Suijten wrote:
> > > > @@ -359,8 +359,8 @@ static void dpu_encoder_phys_cmd_tearcheck_config(
> > > >
d long as well and change the
error checking to check for zero instead of negatives. This change
does not affect runtime at all beyond a minor adjustment to the debug
output.
Suggested-by: Marijn Suijten
Signed-off-by: Dan Carpenter
Reviewed-by: Marijn Suijten
---
v2: update the debug output
vsync_hz);
>
> Nit: no need to print the value here, you know it's zero. Could be
> clarified to just "no vsync clock".
>
Yeah. That's obviously not useful. Sorry, I will resend.
regards,
dan carpenter
d long as well and change the
error checking to check for zero instead of negatives. This change
does not affect runtime at all. It's just a clean up.
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 8
1 file changed, 4 insertions(+), 4 dele
gt; >
> > Would a fixes: be useful?
>
> That would be commit 8b770e3c9824 ("backlight: Add GPIO-based backlight
> driver") from 2013. Maybe a bit old already, but I can surely add it.
Don't add the Fixes tag to this one because it doesn't fix anything, it
just renames stuff. The real fix is later? To be honest, it was kind
of difficult to see where the actual fix was.
Fixes tags for old code is fine... I like to know why bugs are
introduced. Was it adding a feature or part of fix for something else
or a cleanup?
regards,
dan carpenter
-off-by: Thomas Zimmermann
> Benjamin Herrenschmidt
You left out the Cc:
regards,
dan carpenter
ver incorrectly decreases the hardware
> device's reference counter and leaks the fbdev device.
>
> Signed-off-by: Thomas Zimmermann
Fixes: 88017bda96a5 ("ep93xx video driver")
regards,
dan carpenter
grep line to
their scripts to solve that problem. Instead we were having the
opposite discussion the other week where the bpf people didn't want to
backport selftest stuff and Greg wanted to.
https://lore.kernel.org/all/2023052647-tacking-wince-85c5@gregkh/
regards,
dan carpenter
nteger overflow
checking.
> if (!(args = kmalloc(size, GFP_KERNEL)))
> return -ENOMEM;
> args->ioctl.version = 0;
regards,
dan carpenter
r drm_mm_takedown() are holding spinlocks so it's a
sleeping in atomic bug.
The problematic callers are ttm_range_man_fini_nocheck() and
amdgpu_gtt_mgr_fini().
1002 }
regards,
dan carpenter
_client(pdev, ops, id | ID_BIT_AUDIO, vga_dev,
389 false, true);
390 }
regards,
dan carpenter
Static analysis tools complain about the -EINVAL error code being
stored in an unsigned variable. Let's change this to match
the clk_get_rate() function which is type unsigned long and returns
zero on error.
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by
the issue, kindly add following tag where applicable
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
| Closes: https://lore.kernel.org/r/202305260440.7dv6fzhq-...@intel.com/
smatch warnings:
drivers/gpu/drm/drm_file.c:967 drm_show_memory_stats() error: uninitialized
symbol
/amdgpu: Update debugfs for XCC support (v3)")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 9 +
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
ind
On Mon, May 22, 2023 at 10:47:50AM +0200, Marijn Suijten wrote:
> On 2023-05-22 10:48:01, Dan Carpenter wrote:
> > The "vsync_hz" variable is used to store negative error codes so it
> > needs to be signed for the error checking to work correctly.
>
> Nicely spotte
idx, dev_name(&(hdev)->pdev->dev));
^^^
I hate to be picky, but would it be too much to get rid of the parens
around (hdev)?
regards,
dan carpenter
ot;,
2337 hdev->cdev_idx, dev_name(&(hdev)->pdev->dev));
^^
"hdev->pdev" is NULL here so this will crash.
2338
2339 return rc;
2340 }
regards,
dan carpenter
The "vsync_hz" variable is used to store negative error codes so it
needs to be signed for the error checking to work correctly.
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c |
On Mon, May 15, 2023 at 10:11:39AM -0400, Alex Deucher wrote:
> On Mon, May 15, 2023 at 3:17 AM Dan Carpenter
> wrote:
> >
> > On Mon, May 15, 2023 at 09:34:28AM +0800, Su Hui wrote:
> > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> &g
The gaudi2_get_tpc_idle_status() function returned the incorrect variable
so it always returned true.
Fixes: d85f0531b928 ("accel/habanalabs: break is_idle function into per-engine
sub-routines")
Signed-off-by: Dan Carpenter
---
>From static analysis. Not tested.
drivers/acc
u probably want to change the order now that the lengths have
changed. Same in the other places as well.
regards,
dan carpenter
plane_state(new_plane_state,
crtc_state,
1040,
105 INT_MAX, true, false);
regards,
dan carpenter
On Wed, May 10, 2023 at 08:57:03AM -0600, Jeffrey Hugo wrote:
> On 5/3/2023 4:41 AM, Dan Carpenter wrote:
> > Smatch complains that these are not initialized if get_cntl_version()
> > fails but we still print them in the debug message. Not the end of
> > the world, but tru
Smatch complains that these are not initialized if get_cntl_version()
fails but we still print them in the debug message. Not the end of
the world, but true enough. Let's just initialize them to a dummy value
to make the checker happy.
Signed-off-by: Dan Carpenter
---
drivers/accel
On Sat, Apr 15, 2023 at 11:51:28PM +0200, Javier Martinez Canillas wrote:
> Uwe Kleine-König writes:
>
> > On Wed, Mar 22, 2023 at 12:06:55PM +0300, Dan Carpenter wrote:
> >> The devm_drm_dev_alloc() function returns error pointers. It never
> >> returns NULL. F
commit c5c354a3a472 ("drm/udl: Fix inconsistent urbs.count
value during udl_free_urb_list()").
Reported-by: kernel test robot
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/udl/udl_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/udl/udl_main.
On Sat, Apr 15, 2023 at 04:09:03PM +0300, Dan Carpenter wrote:
> On Thu, Apr 13, 2023 at 09:33:17PM +0200, Christophe JAILLET wrote:
> > When dev_err_probe() is called, 'ret' holds the value of the previous
> > successful devm_request_irq() call.
> > 'ret&#
he result is the same (dead system).
But these days we return -EPROBE_DEFER which is not a fatal error and
we're supposed to recover from that without crashing. So on modern
drivers changing the error path from a leak to a crash has a huge
negative impact.
regards,
dan carpenter
/20230416/202304160359.4lhmfolu-...@intel.com/config)
compiler: loongarch64-linux-gcc (GCC) 12.1.0
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
| Link: https://lore.kernel.org/r/202304160359.4lhmfolu-...@intel.com
)")
> Signed-off-by: Christophe JAILLET
> ---
Presumably you already wrote a Coccinelle script for this but I've added
it to Smatch as well.
regards,
dan carpenter
diff --git a/check_zero_to_err_ptr.c b/check_zero_to_err_ptr.c
index 88ca0285948a..fa2a1f1603b2 100644
--- a/check_zero_to
.org/0day-ci/archive/20230409/202304091929.sr0cfhln-...@intel.com/config)
compiler: csky-linux-gcc (GCC) 12.1.0
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
| Link: https://lore.kernel.org/r/202304091929.sr0cfhln
/202304082018.pxawwhse-...@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
| Link: https://lore.kernel.org/r/202304082018.pxawwhse-...@intel.com/
smatch warnings
ops->gpu_bound(pdev, id);
385 }
386 mutex_unlock(&vgasr_mutex);
387
388 return register_client(pdev, ops, id | ID_BIT_AUDIO, vga_dev,
389 false, true);
390 }
regards,
dan carpenter
Don't dereference "db->dsi_dev" when it is an error pointer.
Fixes: 249a4f5e663c ("drm/panel: Add Magnachip D53E6EA8966 Panel Driver")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/panel/panel-magnachip-d53e6ea8966.c | 2 +-
1 file changed, 1 insertion(+), 1 delet
The devm_drm_dev_alloc() function returns error pointers. It never
returns NULL. Fix the check.
Fixes: c87e859cdeb5 ("drm/imx/lcdc: Implement DRM driver for imx25")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/imx/lcdc/imx-lcdc.c | 4 ++--
1 file changed, 2 insertions(+), 2
that if
"ret" is failure then "vbo" is NULL leading to an Oops.
699 return ret;
700 }
regards,
dan carpenter
) 12.1.0
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
| Link: https://lore.kernel.org/r/202303211207.mucst3ck-...@intel.com/
smatch warnings:
drivers/base/power/qos.c:947 dev_pm_qos_update_user_latency_tolerance() error
On Mon, Feb 27, 2023 at 11:13:19AM +0100, Thomas Zimmermann wrote:
> Hi
>
> Am 27.02.23 um 11:07 schrieb Dan Carpenter:
> > The error codes are not set on these error paths.
> >
> > Fixes: 145eed48de27 ("fbdev: Remove conflicting devices on PCI bus&qu
The error codes are not set on these error paths.
Fixes: 145eed48de27 ("fbdev: Remove conflicting devices on PCI bus")
Signed-off-by: Dan Carpenter
Reviewed-by: Thomas Zimmermann
---
v2: I accidentally returned -EINVAL instead -ENODEV.
Add Thomas's Reviewed-by tag.
driv
ted to u32 and returned as
positive values instead of negative error codes.
Fixes: 81cc7e51c4f1 ("drm/mediatek: Allow commands to be sent during video
mode")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions
The error codes are not set on these error paths.
Fixes: 145eed48de27 ("fbdev: Remove conflicting devices on PCI bus")
Signed-off-by: Dan Carpenter
---
drivers/video/fbdev/chipsfb.c | 14 ++
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/video/fbdev
The drmm_encoder_alloc() function returns error pointers. It never
returns NULL. Fix the check accordingly.
Fixes: 7a1adbd23990 ("drm: rcar-du: Use drmm_encoder_alloc() to manage encoder")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/rcar-du/rcar_du_encoder.c | 4 ++--
1 file
l_engine_reset_bh(engine, NULL);
^^
Sleeping.
638 GEM_BUG_ON(rq->fence.error != -EIO);
639
640 engine_unlock_reset_tasklet(engine);
preempt enabled again.
641
642 /* Check that we do not resubmit the held request */
regards,
dan carpenter
, kindly add following tag where applicable
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
smatch warnings:
drivers/gpu/drm/display/drm_dp_mst_topology.c:3316 drm_dp_add_payload_part1()
warn: missing error code 'ret'
vim +/ret +3316 drivers/gpu/drm/display/drm_dp_mst_
The devm_memremap() function doesn't return NULL, it returns error
pointers.
Fixes: 9a10c7e6519b ("drm/simpledrm: Add support for system memory
framebuffers")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/tiny/simpledrm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions
^
so it can't take a mutex or it leads to a sleeping in atomic bug. These
can be detected at runtime by enabling CONFIG_DEBUG_ATOMIC_SLEEP.
regards,
dan carpenter
This code accidentally returns the wrong variable (which is
uninitialized). It should return ret.
Fixes: a309c7194e8a ("drm/vmwgfx: Remove rcu locks from user resources")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx
is can't actually overflow because it's checked in the caller.
Perhaps the careful way to write this is to change size to size_t as you
suggest which fixes the issue for 64bit systems and use size_mul() so it
doesn't overflow on 32bit systems either.
size = size_mul(num_elements, sizeof(u64));
But it doesn't really matter either way because num_elements is capped
in the caller.
regards,
dan carpenter
06 free_mem:
2207 kfree(ts_buff);
2208 return -ENOMEM;
2209 }
regards,
dan carpenter
applicable
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
smatch warnings:
drivers/gpu/drm/msm/msm_atomic.c:194 msm_atomic_commit_tail() error:
uninitialized symbol 'async'.
vim +/async +194 drivers/gpu/drm/msm/msm_atomic.c
d4d2c60497cfc5 Rob Clark2019-
: Dan Carpenter
New smatch warnings:
drivers/gpu/drm/rockchip/rockchip_drm_vop2.c:2330 vop2_create_crtcs() error:
uninitialized symbol 'possible_crtcs'.
vim +/possible_crtcs +2330 drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
fb83276e59f2d6 Michael Riesch 2022-11-30 2249
) 12.1.0
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot
| Reported-by: Dan Carpenter
smatch warnings:
drivers/gpu/drm/bridge/panel.c:367 devm_drm_panel_bridge_add_typed() error:
'bridge' dereferencing possible ERR_PTR()
vim +/bridge +367 d
test robot
| Reported-by: Dan Carpenter
smatch warnings:
drivers/gpu/drm/drm_buddy.c:501 find_continuous_blocks() error: uninitialized
symbol 'block'.
vim +/block +501 drivers/gpu/drm/drm_buddy.c
8a257b57bc11a2 xinhui pan 2022-12-18 472 static struct drm_buddy_block *
8a257b57bc11a2
get_pid(task_pid(task));
839 }
840
841 if (IS_ERR_OR_NULL(aspace))
^^
[QUESTION #3] This check seems reversed. It should be if *NOT* is error
or null.
842 aspace = msm_gem_address_space_get(gpu->aspace);
843
844 return aspace;
845 }
regards,
dan carpenter
vich1ppsetr |= VICH1PPSETR_TXESYNC_PULSE;
^^^
Uninitialized.
373
374 rzg2l_mipi_dsi_link_write(dsi, VICH1PPSETR, vich1ppsetr);
regards,
dan carpenter
33ec ("drm/msm/hdmi: move resource allocation to probe function")
Signed-off-by: Dan Carpenter
---
v2: Add a Fixes tag. Re-work the commit message.
drivers/gpu/drm/msm/hdmi/hdmi.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/dr
)) {
355 mutex_unlock(&vc4_hdmi->mutex);
356 return 0;
357 }
358
359 scrambling_needed =
vc4_hdmi_mode_needs_scrambling(&vc4_hdmi->saved_adjusted_mode,
360
vc4_hdmi->output_bpc,
regards,
dan carpenter
Drop the "gr->fecs.mutex" lock before returning on this error path.
Fixes: ca081fff6ecc ("drm/nouveau/gr/gf100-: generate golden context during
first object alloc")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 +
1 file changed, 1 i
The "&chan->cgrp->mutex" and "&cgrp->mutex" variables refer to the same
thing. Use "&cgrp->mutex" consistently.
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/nouveau/nvkm/engine/fifo/chan.c | 2 +-
1 file changed, 1 insertion(+), 1
201 - 300 of 1065 matches
Mail list logo
