[PATCH] drm/xe/rtp: Check hwe before calling match_func

[PATCH] drm/xe/rtp: Check hwe before calling match_func

[Jonathan Cavitt]

XE_RTP_MATCH_FUNC may attempt to dereference the target xe_hw_engine.
Ensure the hwe is not NULL before calling the function, matching
XE_RTP_MATCH_ENGINE_CLASS, for example.

This covers a static analysis issue.

Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Cc: Gustavo Sousa <gustavo.sousa@intel.com>
---
 drivers/gpu/drm/xe/xe_rtp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/xe/xe_rtp.c b/drivers/gpu/drm/xe/xe_rtp.c
index dec9d94e6fb0..2cd26db113d9 100644
--- a/drivers/gpu/drm/xe/xe_rtp.c
+++ b/drivers/gpu/drm/xe/xe_rtp.c
@@ -129,6 +129,9 @@ static bool rule_match_item(struct rule_match_ctx *match_ctx)
 
 		return hwe->class != r->engine_class;
 	case XE_RTP_MATCH_FUNC:
+		if (drm_WARN_ON(&xe->drm, !hwe))
+			return false;
+
 		return r->match_func(xe, gt, hwe);
 	default:
 		drm_warn(&xe->drm, "Invalid RTP match %u\n",
-- 
2.53.0

RE: [PATCH] drm/xe/rtp: Check hwe before calling match_func

[Cavitt, Jonathan]

-----Original Message-----
From: Cavitt, Jonathan <jonathan.cavitt@intel.com> 
Sent: Thursday, May 28, 2026 2:34 PM
To: dri-devel@lists.freedesktop.org
Cc: Gupta, Saurabhg <saurabhg.gupta@intel.com>; Zuo, Alex <alex.zuo@intel.com>; Cavitt, Jonathan <jonathan.cavitt@intel.com>; Sousa, Gustavo <gustavo.sousa@intel.com>
Subject: [PATCH] drm/xe/rtp: Check hwe before calling match_func
> 
> XE_RTP_MATCH_FUNC may attempt to dereference the target xe_hw_engine.
> Ensure the hwe is not NULL before calling the function, matching
> XE_RTP_MATCH_ENGINE_CLASS, for example.
> 
> This covers a static analysis issue.
> 
> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
> Cc: Gustavo Sousa <gustavo.sousa@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_rtp.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_rtp.c b/drivers/gpu/drm/xe/xe_rtp.c
> index dec9d94e6fb0..2cd26db113d9 100644
> --- a/drivers/gpu/drm/xe/xe_rtp.c
> +++ b/drivers/gpu/drm/xe/xe_rtp.c
> @@ -129,6 +129,9 @@ static bool rule_match_item(struct rule_match_ctx *match_ctx)
>  
>  		return hwe->class != r->engine_class;
>  	case XE_RTP_MATCH_FUNC:
> +		if (drm_WARN_ON(&xe->drm, !hwe))
> +			return false;
> +
>  		return r->match_func(xe, gt, hwe);

I only just now noticed that this is also a possible issue with gt.
I'll wait for a response from Gustavo Sousa before creating a new revision with the added
gt check, as it's possible these checks aren't necessary.  If they aren't necessary, I'll just mark
these as false positives on my end.

-Jonathan Cavitt

>  	default:
>  		drm_warn(&xe->drm, "Invalid RTP match %u\n",
> -- 
> 2.53.0
> 
> 

Re: [PATCH] drm/xe/rtp: Check hwe before calling match_func

[Gustavo Sousa]

Jonathan Cavitt <jonathan.cavitt@intel.com> writes:

> XE_RTP_MATCH_FUNC may attempt to dereference the target xe_hw_engine.
> Ensure the hwe is not NULL before calling the function, matching
> XE_RTP_MATCH_ENGINE_CLASS, for example.
>
> This covers a static analysis issue.
>
> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
> Cc: Gustavo Sousa <gustavo.sousa@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_rtp.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/xe/xe_rtp.c b/drivers/gpu/drm/xe/xe_rtp.c
> index dec9d94e6fb0..2cd26db113d9 100644
> --- a/drivers/gpu/drm/xe/xe_rtp.c
> +++ b/drivers/gpu/drm/xe/xe_rtp.c
> @@ -129,6 +129,9 @@ static bool rule_match_item(struct rule_match_ctx *match_ctx)
>  
>  		return hwe->class != r->engine_class;
>  	case XE_RTP_MATCH_FUNC:
> +		if (drm_WARN_ON(&xe->drm, !hwe))
> +			return false;

There are several functions passed via XE_RTP_MATCH_FUNC() (i.e. MATCH()
in definitions of RTP rules) that are meant to be used to do checks that
do not depend on hwe.  Returning false here is wrong as it will cause
those checks to be skipped.

The developer is responsible for not passing a function that uses hwe in
a context where it is NULL.

--
Gustavo Sousa

> +
>  		return r->match_func(xe, gt, hwe);
>  	default:
>  		drm_warn(&xe->drm, "Invalid RTP match %u\n",
> -- 
> 2.53.0

RE: [PATCH] drm/xe/rtp: Check hwe before calling match_func

[Cavitt, Jonathan]

-----Original Message-----
From: Sousa, Gustavo <gustavo.sousa@intel.com> 
Sent: Thursday, May 28, 2026 3:30 PM
To: Cavitt, Jonathan <jonathan.cavitt@intel.com>; dri-devel@lists.freedesktop.org
Cc: Gupta, Saurabhg <saurabhg.gupta@intel.com>; Zuo, Alex <alex.zuo@intel.com>; Cavitt, Jonathan <jonathan.cavitt@intel.com>
Subject: Re: [PATCH] drm/xe/rtp: Check hwe before calling match_func
> 
> Jonathan Cavitt <jonathan.cavitt@intel.com> writes:
> 
> > XE_RTP_MATCH_FUNC may attempt to dereference the target xe_hw_engine.
> > Ensure the hwe is not NULL before calling the function, matching
> > XE_RTP_MATCH_ENGINE_CLASS, for example.
> >
> > This covers a static analysis issue.
> >
> > Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
> > Cc: Gustavo Sousa <gustavo.sousa@intel.com>
> > ---
> >  drivers/gpu/drm/xe/xe_rtp.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/xe/xe_rtp.c b/drivers/gpu/drm/xe/xe_rtp.c
> > index dec9d94e6fb0..2cd26db113d9 100644
> > --- a/drivers/gpu/drm/xe/xe_rtp.c
> > +++ b/drivers/gpu/drm/xe/xe_rtp.c
> > @@ -129,6 +129,9 @@ static bool rule_match_item(struct rule_match_ctx *match_ctx)
> >  
> >  		return hwe->class != r->engine_class;
> >  	case XE_RTP_MATCH_FUNC:
> > +		if (drm_WARN_ON(&xe->drm, !hwe))
> > +			return false;
> 
> There are several functions passed via XE_RTP_MATCH_FUNC() (i.e. MATCH()
> in definitions of RTP rules) that are meant to be used to do checks that
> do not depend on hwe.  Returning false here is wrong as it will cause
> those checks to be skipped.
> 
> The developer is responsible for not passing a function that uses hwe in
> a context where it is NULL.

Understood, though quick question: is this also the case for GT?
-Jonathan Cavitt

> 
> --
> Gustavo Sousa
> 
> > +
> >  		return r->match_func(xe, gt, hwe);
> >  	default:
> >  		drm_warn(&xe->drm, "Invalid RTP match %u\n",
> > -- 
> > 2.53.0
> 

RE: [PATCH] drm/xe/rtp: Check hwe before calling match_func

[Gustavo Sousa]

"Cavitt, Jonathan" <jonathan.cavitt@intel.com> writes:

> -----Original Message-----
> From: Sousa, Gustavo <gustavo.sousa@intel.com> 
> Sent: Thursday, May 28, 2026 3:30 PM
> To: Cavitt, Jonathan <jonathan.cavitt@intel.com>; dri-devel@lists.freedesktop.org
> Cc: Gupta, Saurabhg <saurabhg.gupta@intel.com>; Zuo, Alex <alex.zuo@intel.com>; Cavitt, Jonathan <jonathan.cavitt@intel.com>
> Subject: Re: [PATCH] drm/xe/rtp: Check hwe before calling match_func
>> 
>> Jonathan Cavitt <jonathan.cavitt@intel.com> writes:
>> 
>> > XE_RTP_MATCH_FUNC may attempt to dereference the target xe_hw_engine.
>> > Ensure the hwe is not NULL before calling the function, matching
>> > XE_RTP_MATCH_ENGINE_CLASS, for example.
>> >
>> > This covers a static analysis issue.
>> >
>> > Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
>> > Cc: Gustavo Sousa <gustavo.sousa@intel.com>
>> > ---
>> >  drivers/gpu/drm/xe/xe_rtp.c | 3 +++
>> >  1 file changed, 3 insertions(+)
>> >
>> > diff --git a/drivers/gpu/drm/xe/xe_rtp.c b/drivers/gpu/drm/xe/xe_rtp.c
>> > index dec9d94e6fb0..2cd26db113d9 100644
>> > --- a/drivers/gpu/drm/xe/xe_rtp.c
>> > +++ b/drivers/gpu/drm/xe/xe_rtp.c
>> > @@ -129,6 +129,9 @@ static bool rule_match_item(struct rule_match_ctx *match_ctx)
>> >  
>> >  		return hwe->class != r->engine_class;
>> >  	case XE_RTP_MATCH_FUNC:
>> > +		if (drm_WARN_ON(&xe->drm, !hwe))
>> > +			return false;
>> 
>> There are several functions passed via XE_RTP_MATCH_FUNC() (i.e. MATCH()
>> in definitions of RTP rules) that are meant to be used to do checks that
>> do not depend on hwe.  Returning false here is wrong as it will cause
>> those checks to be skipped.
>> 
>> The developer is responsible for not passing a function that uses hwe in
>> a context where it is NULL.
>
> Understood, though quick question: is this also the case for GT?

Yep. Some examples:

  * match_has_mert
  * xe_rtp_match_not_sriov_vf
  * xe_rtp_match_has_flat_ccs

--
Gustavo Sousa

> -Jonathan Cavitt
>
>> 
>> --
>> Gustavo Sousa
>> 
>> > +
>> >  		return r->match_func(xe, gt, hwe);
>> >  	default:
>> >  		drm_warn(&xe->drm, "Invalid RTP match %u\n",
>> > -- 
>> > 2.53.0
>>