search for: r535_gsp_cmdq_get

...nvkm_gsp_rpc_get(gsp, NV_VGPU_MSG_FUNCTION_UNLOADING_GUEST_DRIVER, sizeof(*rpc)); >> >> nvkm_gsp_rpc_get() returns NULL on error. > > There are also code paths where it can return an ERR_PTR. I think we need to check for IS_ERR_OR_NULL()... Sorry, this is wrong, I just saw that r535_gsp_cmdq_get() calls r535_gsp_cmdq_get() which returns an ERR_PTR. Put it neither handles the return value of r535_gsp_cmdq_get() as ERR_PTR nor does it pass it through. > >> >> --> 1016???????? if (IS_ERR(rpc)) >> ???? 1017???????????????? return PTR_ERR(rpc); >> ???? 1018 >&...

On 11/7/23 15:34, Dan Carpenter wrote: > Hello Ben Skeggs, > > The patch 176fdcbddfd2: "drm/nouveau/gsp/r535: add support for > booting GSP-RM" from Sep 19, 2023 (linux-next), leads to the > following Smatch static checker warning: > > drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1016 r535_gsp_rpc_unloading_guest_driver() > warn: 'rpc' isn't an

The r535_gsp_cmdq_get() function returns error pointers but this code checks for NULL. Also we need to propagate the error pointer back to the callers in r535_gsp_rpc_get(). Returning NULL will lead to a NULL pointer dereference. Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") S...