[PATCH] drm/amd/display: remove an unnecessary NULL check
The 'pipe' can't be NULL because it points to an element of array.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixed: 7cf2c840c6b5 (drm/amd/display: Commit validation set from state)
Signed-off-by: Danila Chernetsov
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c
b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 0cb8d1f934d1..d3b850372eb3 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1854,7 +1854,7 @@ static enum dc_status dc_commit_state_no_check(struct dc
*dc, struct dc_state *c
for (k = 0; k < MAX_PIPES; k++) {
pipe = &context->res_ctx.pipe_ctx[k];
- for (l = 0 ; pipe && l < context->stream_count; l++) {
+ for (l = 0 ; l < context->stream_count; l++) {
if (context->streams[l] &&
context->streams[l] == pipe->stream &&
dc->hwss.setup_stereo)
--
2.25.1
[no subject]
Date: Sat, 11 Mar 2023 19:00:03 + Subject: [PATCH 5.10 1/1] drm/amdgpu: add error handling for drm_fb_helper_initial_config The type of return value of drm_fb_helper_initial_config is int, which may return wrong result, so we add error handling for it to reclaim memory resource, and return when an error occurs. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: d38ceaf99ed0 (drm/amdgpu: add core driver (v4)) Signed-off-by: Danila Chernetsov --- drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 13 +++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c index 43f29ee0e3b0..e445a2c9f569 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c @@ -348,8 +348,17 @@ int amdgpu_fbdev_init(struct amdgpu_device *adev) if (!amdgpu_device_has_dc_support(adev)) drm_helper_disable_unused_functions(adev_to_drm(adev)); - drm_fb_helper_initial_config(&rfbdev->helper, bpp_sel); - return 0; + ret = drm_fb_helper_initial_config(&rfbdev->helper, bpp_sel); + if (ret) + goto fini; + + return 0; + +fini: + drm_fb_helper_fini(&rfbdev->helper); + + kfree(rfbdev); + return ret; } void amdgpu_fbdev_fini(struct amdgpu_device *adev) -- 2.25.1
[PATCH v5.10 1/1] drm/amdgpu: add error handling for drm_fb_helper_initial_config
The type of return value of drm_fb_helper_initial_config is int, which may return wrong result, so we add error handling for it to reclaim memory resource, and return when an error occurs. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: d38ceaf99ed0 (drm/amdgpu: add core driver (v4)) Signed-off-by: Danila Chernetsov --- drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 13 +++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c index 43f29ee0e3b0..e445a2c9f569 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c @@ -348,8 +348,17 @@ int amdgpu_fbdev_init(struct amdgpu_device *adev) if (!amdgpu_device_has_dc_support(adev)) drm_helper_disable_unused_functions(adev_to_drm(adev)); - drm_fb_helper_initial_config(&rfbdev->helper, bpp_sel); - return 0; + ret = drm_fb_helper_initial_config(&rfbdev->helper, bpp_sel); + if (ret) + goto fini; + + return 0; + +fini: + drm_fb_helper_fini(&rfbdev->helper); + + kfree(rfbdev); + return ret; } void amdgpu_fbdev_fini(struct amdgpu_device *adev) -- 2.25.1
[PATCH] drm/etnaviv: Added error handling for dma_map_sgtable.
Added error handling for dma_map_sgtable.
If an error occurs, the sgt table is freed.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 182354a526a0 ("drm: etnaviv: fix common struct sg_table related issues")
Signed-off-by: Danila Chernetsov
---
drivers/gpu/drm/etnaviv/etnaviv_gem.c | 14 +++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index b5f73502e3dd..59d1684dafc4 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -17,7 +17,7 @@
static struct lock_class_key etnaviv_shm_lock_class;
static struct lock_class_key etnaviv_userptr_lock_class;
-static void etnaviv_gem_scatter_map(struct etnaviv_gem_object *etnaviv_obj)
+static int etnaviv_gem_scatter_map(struct etnaviv_gem_object *etnaviv_obj)
{
struct drm_device *dev = etnaviv_obj->base.dev;
struct sg_table *sgt = etnaviv_obj->sgt;
@@ -27,7 +27,9 @@ static void etnaviv_gem_scatter_map(struct etnaviv_gem_object
*etnaviv_obj)
* because display controller, GPU, etc. are not coherent.
*/
if (etnaviv_obj->flags & ETNA_BO_CACHE_MASK)
- dma_map_sgtable(dev->dev, sgt, DMA_BIDIRECTIONAL, 0);
+ return dma_map_sgtable(dev->dev, sgt, DMA_BIDIRECTIONAL, 0);
+
+ return 0;
}
static void etnaviv_gem_scatterlist_unmap(struct etnaviv_gem_object
*etnaviv_obj)
@@ -113,7 +115,13 @@ struct page **etnaviv_gem_get_pages(struct
etnaviv_gem_object *etnaviv_obj)
etnaviv_obj->sgt = sgt;
- etnaviv_gem_scatter_map(etnaviv_obj);
+ ret = etnaviv_gem_scatter_map(etnaviv_obj);
+ if (ret < 0) {
+ sg_free_table(etnaviv_obj->sgt);
+ kfree(etnaviv_obj->sgt);
+ etnaviv_obj->sgt = NULL;
+ return ERR_PTR(ret);
+ }
}
return etnaviv_obj->pages;
--
2.25.1
[PATCH] video: fbdev: sm501fb: Add some geometry checks.
Added checks for xoffset, yoffset settings.
Incorrect settings of these parameters can lead to errors
in sm501fb_pan_ functions.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 5fc404e47bdf ("[PATCH] fb: SM501 framebuffer driver")
Signed-off-by: Danila Chernetsov
---
drivers/video/fbdev/sm501fb.c | 7 +++
1 file changed, 7 insertions(+)
diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c
index 7734377b2d87..ed6f4f43e2d5 100644
--- a/drivers/video/fbdev/sm501fb.c
+++ b/drivers/video/fbdev/sm501fb.c
@@ -327,6 +327,13 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var,
if (var->xres_virtual > 4096 || var->yres_virtual > 2048)
return -EINVAL;
+ /* geometry sanity checks */
+ if (var->xres + var->xoffset > var->xres_virtual)
+ return -EINVAL;
+
+ if (var->yres + var->yoffset > var->yres_virtual)
+ return -EINVAL;
+
/* can cope with 8,16 or 32bpp */
if (var->bits_per_pixel <= 8)
--
2.25.1
[PATCH] video: fbdev: kyro: Add some geometry checks.
The check protects against division by 0, integer wraparound,
and overflow Start/End window settings.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Danila Chernetsov
---
drivers/video/fbdev/kyro/fbdev.c | 7 +++
1 file changed, 7 insertions(+)
diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 08ee8baa79f8..1d5246313d9a 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -378,6 +378,13 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32
ulWidth, u32 ulHeight
(x < 2 && ulWidth + 2 == 0))
return -EINVAL;
+ /* The check protects against division by 0, integer wraparound,
+* and overflow Start/End window settings.
+*/
+ if (x + ulWidth - 1 <= x || y + ulHeight - 1 <= y ||
+ x + ulWidth - 1 > 65535 || y + ulHeight - 1 > 65535)
+ return -EINVAL;
+
/* Stop Ramdac Output */
DisableRamdacOutput(deviceInfo.pSTGReg);
--
2.25.1
