Hi Sean, url: https://github.com/0day-ci/linux/commits/Sean-Z-Huang/drm-i915-pxp-Introd... base: 92edc4aef86780a8ad01b092c6d6630bb3cb423d config: i386-randconfig-m021-20201115 (attached as .config) compiler: gcc-9 (Debian 9.3.0-15) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com&gt; smatch warnings: drivers/gpu/drm/i915/pxp/intel_pxp.c:62 i915_pxp_ops_ioctl() error: we previously assumed 'i915' could be null (see line 20) vim +/i915 +62 drivers/gpu/drm/i915/pxp/intel_pxp.c 1d109ada10e82c3 Huang, Sean Z 2020-11-13 11 int i915_pxp_ops_ioctl(struct drm_device *dev, void *data, struct drm_file *drmfile) 1d109ada10e82c3 Huang, Sean Z 2020-11-13 12 { 1d109ada10e82c3 Huang, Sean Z 2020-11-13 13 int ret; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 14 struct pxp_info pxp_info = {0}; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 15 struct drm_i915_pxp_ops *pxp_ops = data; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 16 struct drm_i915_private *i915 = to_i915(dev); 1d109ada10e82c3 Huang, Sean Z 2020-11-13 17 1d109ada10e82c3 Huang, Sean Z 2020-11-13 18 drm_dbg(&i915->drm, ">>> %s\n", __func__); ^^^^^^^^^ If "i915" is NULL then this will crash. 1d109ada10e82c3 Huang, Sean Z 2020-11-13 19 1d109ada10e82c3 Huang, Sean Z 2020-11-13 @20 if (!i915 || !drmfile || !pxp_ops || pxp_ops->pxp_info_size != sizeof(pxp_info)) { ^^^^ Check too late. 1d109ada10e82c3 Huang, Sean Z 2020-11-13 21 drm_dbg(&i915->drm, "Failed to %s, invalid params\n", __func__); 1d109ada10e82c3 Huang, Sean Z 2020-11-13 22 ret = -EINVAL; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 23 goto end; This will unlock a lock that we are not holding. This should just "return -EINVAL;". All the stuff at "goto end;" is pointless or buggy. 1d109ada10e82c3 Huang, Sean Z 2020-11-13 24 } 1d109ada10e82c3 Huang, Sean Z 2020-11-13 25 1d109ada10e82c3 Huang, Sean Z 2020-11-13 26 if (copy_from_user(&pxp_info, (void __user *)pxp_ops->pxp_info_ptr, sizeof(pxp_info)) != 0) { 1d109ada10e82c3 Huang, Sean Z 2020-11-13 27 ret = -EFAULT; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 28 goto end; ^^^^^^^^ This will unlock. Same. Just return -EFAULT; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 29 } 1d109ada10e82c3 Huang, Sean Z 2020-11-13 30 1d109ada10e82c3 Huang, Sean Z 2020-11-13 31 drm_dbg(&i915->drm, "i915 pxp ioctl call with action=[%d]\n", pxp_info.action); 1d109ada10e82c3 Huang, Sean Z 2020-11-13 32 1d109ada10e82c3 Huang, Sean Z 2020-11-13 33 mutex_lock(&i915->pxp.r0ctx->ctx_mutex); 1d109ada10e82c3 Huang, Sean Z 2020-11-13 34 1d109ada10e82c3 Huang, Sean Z 2020-11-13 35 if (i915->pxp.r0ctx->global_state_in_suspend) { 1d109ada10e82c3 Huang, Sean Z 2020-11-13 36 drm_dbg(&i915->drm, "Return failure due to state in suspend\n"); 1d109ada10e82c3 Huang, Sean Z 2020-11-13 37 pxp_info.sm_status = PXP_SM_STATUS_SESSION_NOT_AVAILABLE; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 38 ret = 0; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 39 goto end; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 40 } 1d109ada10e82c3 Huang, Sean Z 2020-11-13 41 1d109ada10e82c3 Huang, Sean Z 2020-11-13 42 if (i915->pxp.r0ctx->global_state_attacked) { 1d109ada10e82c3 Huang, Sean Z 2020-11-13 43 drm_dbg(&i915->drm, "Retry required due to state attacked\n"); 1d109ada10e82c3 Huang, Sean Z 2020-11-13 44 pxp_info.sm_status = PXP_SM_STATUS_RETRY_REQUIRED; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 45 ret = 0; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 46 goto end; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 47 } 1d109ada10e82c3 Huang, Sean Z 2020-11-13 48 1d109ada10e82c3 Huang, Sean Z 2020-11-13 49 switch (pxp_info.action) { 1d109ada10e82c3 Huang, Sean Z 2020-11-13 50 case PXP_ACTION_SET_R3_CONTEXT: 1d109ada10e82c3 Huang, Sean Z 2020-11-13 51 { 1d109ada10e82c3 Huang, Sean Z 2020-11-13 52 ret = intel_pxp_set_r3ctx(i915, pxp_info.set_r3ctx); 1d109ada10e82c3 Huang, Sean Z 2020-11-13 53 break; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 54 } 1d109ada10e82c3 Huang, Sean Z 2020-11-13 55 default: 1d109ada10e82c3 Huang, Sean Z 2020-11-13 56 drm_dbg(&i915->drm, "Failed to %s due to bad params\n", __func__); 1d109ada10e82c3 Huang, Sean Z 2020-11-13 57 ret = -EINVAL; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 58 goto end; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 59 } 1d109ada10e82c3 Huang, Sean Z 2020-11-13 60 1d109ada10e82c3 Huang, Sean Z 2020-11-13 61 end: 1d109ada10e82c3 Huang, Sean Z 2020-11-13 @62 mutex_unlock(&i915->pxp.r0ctx->ctx_mutex); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1d109ada10e82c3 Huang, Sean Z 2020-11-13 63 1d109ada10e82c3 Huang, Sean Z 2020-11-13 64 if (ret == 0) 1d109ada10e82c3 Huang, Sean Z 2020-11-13 65 if (copy_to_user((void __user *)pxp_ops->pxp_info_ptr, &pxp_info, sizeof(pxp_info)) != 0) 1d109ada10e82c3 Huang, Sean Z 2020-11-13 66 ret = -EFAULT; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 67 1d109ada10e82c3 Huang, Sean Z 2020-11-13 68 if (ret) 1d109ada10e82c3 Huang, Sean Z 2020-11-13 69 dev_err(&dev->pdev->dev, "pid=%d, ret = %d\n", task_pid_nr(current), ret); 1d109ada10e82c3 Huang, Sean Z 2020-11-13 70 1d109ada10e82c3 Huang, Sean Z 2020-11-13 71 drm_dbg(&i915->drm, "<<< %s\n", __func__); Delete this printk() and use ftrace for this information. 1d109ada10e82c3 Huang, Sean Z 2020-11-13 72 return ret; 1d109ada10e82c3 Huang, Sean Z 2020-11-13 73 } --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org