drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c:664 amdgpu_userq_wait_count_fences() warn: passing freed memory 'fence' (line 652)
kernel test robot <[email protected]>
| Newsgroups | dev.linux.lists.oe-kbuild |
|---|---|
| Message-ID | <[email protected]> |
BCC: [email protected] CC: [email protected] CC: [email protected] TO: "Christian König" <[email protected]> CC: Alex Deucher <[email protected]> CC: Sunil Khatri <[email protected]> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 87320be9f0d24fce67631b7eef919f0b79c3e45c commit: a1371d9f0e611ef40cd31b02565e2325701c1d82 drm/amdgpu: rework amdgpu_userq_wait_ioctl v4 date: 4 months ago :::::: branch date: 8 hours ago :::::: commit date: 4 months ago config: sparc-randconfig-r071-20260702 (https://download.01.org/0day-ci/archive/20260703/[email protected]/config) compiler: sparc64-linux-gcc (GCC) 13.4.0 smatch: v0.5.0-9185-gbcc58b9c If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Fixes: a1371d9f0e61 ("drm/amdgpu: rework amdgpu_userq_wait_ioctl v4") | Reported-by: kernel test robot <[email protected]> | Reported-by: Dan Carpenter <[email protected]> | Closes: https://lore.kernel.org/r/[email protected]/ New smatch warnings: drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c:664 amdgpu_userq_wait_count_fences() warn: passing freed memory 'fence' (line 652) Old smatch warnings: drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c:599 amdgpu_userq_signal_ioctl() error: we previously assumed 'gobj_write' could be null (see line 581) drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c:603 amdgpu_userq_signal_ioctl() error: we previously assumed 'gobj_read' could be null (see line 573) vim +/fence +664 drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 618 a1371d9f0e611e Christian König 2026-01-29 619 /* Count the number of expected fences so userspace can alloc a buffer */ a1371d9f0e611e Christian König 2026-01-29 620 static int a1371d9f0e611e Christian König 2026-01-29 621 amdgpu_userq_wait_count_fences(struct drm_file *filp, a1371d9f0e611e Christian König 2026-01-29 622 struct drm_amdgpu_userq_wait *wait_info, a1371d9f0e611e Christian König 2026-01-29 623 u32 *syncobj_handles, u32 *timeline_points, a1371d9f0e611e Christian König 2026-01-29 624 u32 *timeline_handles, a1371d9f0e611e Christian König 2026-01-29 625 struct drm_gem_object **gobj_write, a1371d9f0e611e Christian König 2026-01-29 626 struct drm_gem_object **gobj_read) a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 627 { a1371d9f0e611e Christian König 2026-01-29 628 int num_read_bo_handles, num_write_bo_handles; a1371d9f0e611e Christian König 2026-01-29 629 struct dma_fence_unwrap iter; a1371d9f0e611e Christian König 2026-01-29 630 struct dma_fence *fence, *f; a1371d9f0e611e Christian König 2026-01-29 631 unsigned int num_fences = 0; a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 632 struct drm_exec exec; a1371d9f0e611e Christian König 2026-01-29 633 int i, r; cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 634 a1371d9f0e611e Christian König 2026-01-29 635 /* a1371d9f0e611e Christian König 2026-01-29 636 * This needs to be outside of the lock provided by drm_exec for a1371d9f0e611e Christian König 2026-01-29 637 * DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT to work correctly. a1371d9f0e611e Christian König 2026-01-29 638 */ 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 639 a1371d9f0e611e Christian König 2026-01-29 640 /* Count timeline fences */ a1371d9f0e611e Christian König 2026-01-29 641 for (i = 0; i < wait_info->num_syncobj_timeline_handles; i++) { 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 642 r = drm_syncobj_find_fence(filp, timeline_handles[i], 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 643 timeline_points[i], 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 644 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT, 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 645 &fence); 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 646 if (r) a1371d9f0e611e Christian König 2026-01-29 647 return r; 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 648 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 649 dma_fence_unwrap_for_each(f, &iter, fence) 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 650 num_fences++; 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 651 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 @652 dma_fence_put(fence); 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 653 } 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 654 a1371d9f0e611e Christian König 2026-01-29 655 /* Count boolean fences */ a1371d9f0e611e Christian König 2026-01-29 656 for (i = 0; i < wait_info->num_syncobj_handles; i++) { a1371d9f0e611e Christian König 2026-01-29 657 r = drm_syncobj_find_fence(filp, syncobj_handles[i], 0, 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 658 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT, 15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 659 &fence); a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 660 if (r) a1371d9f0e611e Christian König 2026-01-29 661 return r; a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 662 a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 663 num_fences++; a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 @664 dma_fence_put(fence); a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 665 } a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 666 a1371d9f0e611e Christian König 2026-01-29 667 /* Lock all the GEM objects */ a1371d9f0e611e Christian König 2026-01-29 668 /* TODO: It is actually not necessary to lock them */ a1371d9f0e611e Christian König 2026-01-29 669 num_read_bo_handles = wait_info->num_bo_read_handles; a1371d9f0e611e Christian König 2026-01-29 670 num_write_bo_handles = wait_info->num_bo_write_handles; a1371d9f0e611e Christian König 2026-01-29 671 drm_exec_init(&exec, DRM_EXEC_INTERRUPTIBLE_WAIT, a1371d9f0e611e Christian König 2026-01-29 672 num_read_bo_handles + num_write_bo_handles); a1371d9f0e611e Christian König 2026-01-29 673 a1371d9f0e611e Christian König 2026-01-29 674 drm_exec_until_all_locked(&exec) { a1371d9f0e611e Christian König 2026-01-29 675 r = drm_exec_prepare_array(&exec, gobj_read, a1371d9f0e611e Christian König 2026-01-29 676 num_read_bo_handles, 1); a1371d9f0e611e Christian König 2026-01-29 677 drm_exec_retry_on_contention(&exec); a1371d9f0e611e Christian König 2026-01-29 678 if (r) a1371d9f0e611e Christian König 2026-01-29 679 goto error_unlock; a1371d9f0e611e Christian König 2026-01-29 680 a1371d9f0e611e Christian König 2026-01-29 681 r = drm_exec_prepare_array(&exec, gobj_write, a1371d9f0e611e Christian König 2026-01-29 682 num_write_bo_handles, 1); a1371d9f0e611e Christian König 2026-01-29 683 drm_exec_retry_on_contention(&exec); a1371d9f0e611e Christian König 2026-01-29 684 if (r) a1371d9f0e611e Christian König 2026-01-29 685 goto error_unlock; a1371d9f0e611e Christian König 2026-01-29 686 } a1371d9f0e611e Christian König 2026-01-29 687 a1371d9f0e611e Christian König 2026-01-29 688 /* Count read fences */ cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 689 for (i = 0; i < num_read_bo_handles; i++) { a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 690 struct dma_resv_iter resv_cursor; a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 691 struct dma_fence *fence; a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 692 cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 693 dma_resv_for_each_fence(&resv_cursor, gobj_read[i]->resv, cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 694 DMA_RESV_USAGE_READ, fence) cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 695 num_fences++; cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 696 } cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 697 a1371d9f0e611e Christian König 2026-01-29 698 /* Count write fences */ cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 699 for (i = 0; i < num_write_bo_handles; i++) { cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 700 struct dma_resv_iter resv_cursor; cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 701 struct dma_fence *fence; cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 702 cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 703 dma_resv_for_each_fence(&resv_cursor, gobj_write[i]->resv, cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 704 DMA_RESV_USAGE_WRITE, fence) a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 705 num_fences++; a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 706 } a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 707 a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 708 wait_info->num_fences = num_fences; a1371d9f0e611e Christian König 2026-01-29 709 r = 0; a1371d9f0e611e Christian König 2026-01-29 710 a1371d9f0e611e Christian König 2026-01-29 711 error_unlock: a1371d9f0e611e Christian König 2026-01-29 712 /* Unlock all the GEM objects */ a1371d9f0e611e Christian König 2026-01-29 713 drm_exec_fini(&exec); a1371d9f0e611e Christian König 2026-01-29 714 return r; a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 715 } a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 716 :::::: The code at line 664 was first introduced by commit :::::: a292fdecd72834b3bec380baa5db1e69e7f70679 drm/amdgpu: Implement userqueue signal/wait IOCTL :::::: TO: Arunpravin Paneer Selvam <[email protected]> :::::: CC: Alex Deucher <[email protected]> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki