The logic in this function is a little tricky (though correct).

Explain how an invaviant is satisfied and add an assertion to check
(never hit that one). As a side benefit clang doesn't bitch about a
possible NULL deref now.

1 files changed, 10 insertions, 0 deletions

diff --git a/sys/dev/pci/drm/i915_drv.c b/sys/dev/pci/drm/i915_drv.c
index f8d52605544..6801b390fe7 100644
--- a/sys/dev/pci/drm/i915_drv.c
+++ b/sys/dev/pci/drm/i915_drv.c
@@ -2229,6 +2229,16 @@ again:
 		goto again;
 	}
 
+	/*
+	 * Here we will either have found a register in the first
+	 * loop, or we will have waited for one and in the second case
+	 * and thus have grabbed the object in question, freed the register
+	 * then redone the second loop (having relocked the fence list).
+	 * Therefore at this point it is impossible to have a null value
+	 * in reg.
+	 */
+	KASSERT(reg != NULL);
+
 	obj_priv->fence_reg = i;
 	reg->obj = obj;
 	TAILQ_INSERT_TAIL(&dev_priv->mm.fence_list, reg, list);