From patchwork Wed Mar 21 19:06:53 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Colin King X-Patchwork-Id: 10300081 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id F209F60386 for ; Wed, 21 Mar 2018 19:07:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D0DD928802 for ; Wed, 21 Mar 2018 19:07:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C52EF298D8; Wed, 21 Mar 2018 19:07:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5686B28802 for ; Wed, 21 Mar 2018 19:07:03 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 315AE6E991; Wed, 21 Mar 2018 19:07:02 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from youngberry.canonical.com (youngberry.canonical.com [91.189.89.112]) by gabe.freedesktop.org (Postfix) with ESMTPS id 0FB316E991; Wed, 21 Mar 2018 19:07:00 +0000 (UTC) Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1eyj4X-0001j8-Qh; Wed, 21 Mar 2018 19:06:53 +0000 From: Colin King To: Zhenyu Wang , Zhi Wang , Jani Nikula , Joonas Lahtinen , Rodrigo Vivi , David Airlie , intel-gvt-dev@lists.freedesktop.org, intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org Subject: [PATCH] drm/i915/gvt: don't dereference 'workload' before null checking it Date: Wed, 21 Mar 2018 19:06:53 +0000 Message-Id: <20180321190653.3829-1-colin.king@canonical.com> X-Mailer: git-send-email 2.15.1 MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Colin Ian King The pointer workload is dereferenced before it is null checked, hence there is a potential for a null pointer dereference on workload. Fix this by only dereferencing workload after it is null checked. Detected by CoverityScan, CID#1466017 ("Dereference before null check") Fixes: fa3dd623e559 ("drm/i915/gvt: keep oa config in shadow ctx") Signed-off-by: Colin Ian King --- drivers/gpu/drm/i915/gvt/scheduler.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c index 068126404151..f3010e365a48 100644 --- a/drivers/gpu/drm/i915/gvt/scheduler.c +++ b/drivers/gpu/drm/i915/gvt/scheduler.c @@ -60,9 +60,9 @@ static void set_context_pdp_root_pointer( static void sr_oa_regs(struct intel_vgpu_workload *workload, u32 *reg_state, bool save) { - struct drm_i915_private *dev_priv = workload->vgpu->gvt->dev_priv; - u32 ctx_oactxctrl = dev_priv->perf.oa.ctx_oactxctrl_offset; - u32 ctx_flexeu0 = dev_priv->perf.oa.ctx_flexeu0_offset; + struct drm_i915_private *dev_priv; + u32 ctx_oactxctrl; + u32 ctx_flexeu0; int i = 0; u32 flex_mmio[] = { i915_mmio_reg_offset(EU_PERF_CNTL0), @@ -77,6 +77,10 @@ static void sr_oa_regs(struct intel_vgpu_workload *workload, if (!workload || !reg_state || workload->ring_id != RCS) return; + dev_priv = workload->vgpu->gvt->dev_priv; + ctx_oactxctrl = dev_priv->perf.oa.ctx_oactxctrl_offset; + ctx_flexeu0 = dev_priv->perf.oa.ctx_flexeu0_offset; + if (save) { workload->oactxctrl = reg_state[ctx_oactxctrl + 1];