Hello Nouveau Devs, Commit 9e9944449023 ("drm/nouveau/disp/r535: initial support") from Sep 19, 2023 (linux-next), leads to the following Smatch static checker warning: drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c:1482 r535_disp_oneinit() error: potential NULL/IS_ERR bug 'ctrl' drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c:1582 r535_disp_oneinit() error: potential NULL/IS_ERR bug 'ctrl' drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c:1596 r535_disp_oneinit() error: potential NULL/IS_ERR bug 'ctrl' drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c:1625 r535_disp_oneinit() error: potential NULL/IS_ERR bug 'ctrl' drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c:519 r535_fifo_ectx_size() error: potential NULL/IS_ERR bug 'ctrl' drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c:556 r535_fifo_runl_ctor() error: potential NULL/IS_ERR bug 'ctrl' drivers/gpu/drm/nouveau/nvkm/engine/fifo/r535.c:631 r535_fifo_runl_ctor() error: potential NULL/IS_ERR bug 'ctrl' drivers/gpu/drm/nouveau/nvkm/engine/disp/r535.c 1432 static int 1433 r535_disp_oneinit(struct nvkm_disp *disp) 1434 { 1435 struct nvkm_device *device = disp->engine.subdev.device; 1436 struct nvkm_gsp *gsp = device->gsp; 1437 NV2080_CTRL_INTERNAL_DISPLAY_WRITE_INST_MEM_PARAMS *ctrl; 1438 int ret, i; 1439 1440 /* RAMIN. */ 1441 ret = nvkm_gpuobj_new(device, 0x10000, 0x10000, false, NULL, &disp->inst); 1442 if (ret) 1443 return ret; 1444 1445 if (WARN_ON(nvkm_memory_target(disp->inst->memory) != NVKM_MEM_TARGET_VRAM)) 1446 return -EINVAL; 1447 1448 ctrl = nvkm_gsp_rm_ctrl_get(&gsp->internal.device.subdevice, 1449 NV2080_CTRL_CMD_INTERNAL_DISPLAY_WRITE_INST_MEM, 1450 sizeof(*ctrl)); 1451 if (IS_ERR(ctrl)) 1452 return PTR_ERR(ctrl); 1453 1454 ctrl->instMemPhysAddr = nvkm_memory_addr(disp->inst->memory); 1455 ctrl->instMemSize = nvkm_memory_size(disp->inst->memory); 1456 ctrl->instMemAddrSpace = ADDR_FBMEM; 1457 ctrl->instMemCpuCacheAttr = NV_MEMORY_WRITECOMBINED; 1458 1459 ret = nvkm_gsp_rm_ctrl_wr(&gsp->internal.device.subdevice, ctrl); 1460 if (ret) 1461 return ret; 1462 1463 /* OBJs. */ 1464 ret = nvkm_gsp_client_device_ctor(gsp, &disp->rm.client, &disp->rm.device); 1465 if (ret) 1466 return ret; 1467 1468 ret = nvkm_gsp_rm_alloc(&disp->rm.device.object, 0x00730000, NV04_DISPLAY_COMMON, 0, 1469 &disp->rm.objcom); 1470 if (ret) 1471 return ret; 1472 1473 { 1474 NV2080_CTRL_INTERNAL_DISPLAY_GET_STATIC_INFO_PARAMS *ctrl; 1475 1476 ctrl = nvkm_gsp_rm_ctrl_rd(&gsp->internal.device.subdevice, 1477 NV2080_CTRL_CMD_INTERNAL_DISPLAY_GET_STATIC_INFO, 1478 sizeof(*ctrl)); 1479 if (IS_ERR(ctrl)) The problem here is that r535_gsp_rpc_push() returns a mix of error pointers and NULL. I've written a blog about how mixing error pointers and NULL normally works and I think there is some kind of similar logic here but I forget what it is... https://staticthinking.wordpress.com/2022/08/01/mixing-error-pointers-and-null/ 1480 return PTR_ERR(ctrl); 1481 --> 1482 disp->wndw.mask = ctrl->windowPresentMask; ^^^^^^ Potential NULL dereference. 1483 disp->wndw.nr = fls(disp->wndw.mask); 1484 nvkm_gsp_rm_ctrl_done(&gsp->internal.device.subdevice, ctrl); 1485 } 1486 1487 /* */ 1488 { 1489 #if defined(CONFIG_ACPI) && defined(CONFIG_X86) 1490 NV2080_CTRL_INTERNAL_INIT_BRIGHTC_STATE_LOAD_PARAMS *ctrl; 1491 struct nvkm_gsp_object *subdevice = &disp->rm.client.gsp->internal.device.subdevice; 1492 1493 ctrl = nvkm_gsp_rm_ctrl_get(subdevice, 1494 NV2080_CTRL_CMD_INTERNAL_INIT_BRIGHTC_STATE_LOAD, 1495 sizeof(*ctrl)); 1496 if (IS_ERR(ctrl)) regards, dan carpenter