2022-11-10 12:54:21

by Denis Arefev

Subject: [PATCH] nbio_v7_4: Add pointer check

Return value of a function 'amdgpu_ras_find_obj' is dereferenced at nbio_v7_4.c:325 without checking for null

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Denis Arefev <[email protected]>
---
drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
index eadc9526d33f..0f2ac99de864 100644
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
@@ -304,6 +304,9 @@ static void nbio_v7_4_handle_ras_controller_intr_no_bifring(struct amdgpu_device
struct ras_err_data err_data = {0, 0, 0, NULL};
struct amdgpu_ras *ras = amdgpu_ras_get_context(adev);

+ if (!obj)
+ return;

bif_doorbell_intr_cntl = RREG32_SOC15(NBIO, 0, mmBIF_DOORBELL_INT_CNTL);
if (REG_GET_FIELD(bif_doorbell_intr_cntl,
BIF_DOORBELL_INT_CNTL, RAS_CNTLR_INTERRUPT_STATUS)) {
--
2.25.1

2022-11-10 22:11:32

by Mario Limonciello

Subject: Re: nbio_v7_4: Add pointer check

On 11/10/2022 06:28, Denis Arefev wrote:
> Return value of a function 'amdgpu_ras_find_obj' is dereferenced at nbio_v7_4.c:325 without checking for null

This line is too long, you should be wrapping lines at 75 characters.
Could you run your patch through checkpatch?

>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Denis Arefev <[email protected]>

Probably should include this tag:

Fixes: 28f87950d935e ("drm/amdgpu: clear ras controller status registers
when interrupt occurs")

> ---
> drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
> index eadc9526d33f..0f2ac99de864 100644
> --- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
> +++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
> @@ -304,6 +304,9 @@ static void nbio_v7_4_handle_ras_controller_intr_no_bifring(struct amdgpu_device
> struct ras_err_data err_data = {0, 0, 0, NULL};
> struct amdgpu_ras *ras = amdgpu_ras_get_context(adev);
>
> + if (!obj)
> + return;
>

Whitespace seems inconsistent here.

> bif_doorbell_intr_cntl = RREG32_SOC15(NBIO, 0, mmBIF_DOORBELL_INT_CNTL);
> if (REG_GET_FIELD(bif_doorbell_intr_cntl,
> BIF_DOORBELL_INT_CNTL, RAS_CNTLR_INTERRUPT_STATUS)) {