Skip to contentSkip to conversation

drm/atomic: Pass the full state to planes async atomic check and update

bug report Dan Carpenter 1 participant 1 message Jun 6, 2023 Arm MediaTek

lore
Share & tools
lore
#0 lore raw

Hello Maxime Ripard,

This is a semi-automatic email about new static checker warnings.

The patch 5ddb0bd4ddc3: "drm/atomic: Pass the full state to planes async atomic check and update" from Feb 19, 2021, leads to the following Smatch complaint:

drivers/gpu/drm/mediatek/mtk_drm_plane.c:125 mtk_plane_atomic_async_check()
warn: variable dereferenced before check 'state' (see line 106)

drivers/gpu/drm/mediatek/mtk_drm_plane.c
103 static int mtk_plane_atomic_async_check(struct drm_plane *plane,
104 struct drm_atomic_state *state)
105 {
106 struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,

                                                                                         ^^^^^

The patch adds an unchecked dereference

107 plane);
108 struct drm_crtc_state *crtc_state;
109 int ret;
110
111 if (plane != new_plane_state->crtc->cursor)
112 return -EINVAL;
113
114 if (!plane->state)
115 return -EINVAL;
116
117 if (!plane->state->fb)
118 return -EINVAL;
119
120 ret = mtk_drm_crtc_plane_check(new_plane_state->crtc, plane,
121 to_mtk_plane_state(new_plane_state));
122 if (ret)
123 return ret;
124
125 if (state)

                    ^^^^^

But the existing code has a check for NULL and comments explaining when state can be NULL.

126 crtc_state = drm_atomic_get_existing_crtc_state(state,
127 new_plane_state->crtc);
128 else /* Special case for asynchronous cursor updates. */
129 crtc_state = new_plane_state->crtc->state;
130
131 return drm_atomic_helper_check_plane_state(plane->state, crtc_state,

   132                                                     DRM_PLANE_NO_SCALING,
   133                                                     DRM_PLANE_NO_SCALING,
   134                                                     true, true);

135 }

regards,
dan carpenter