Re: [PATCH v4 2/7] drm/xe/devcoredump: Add GuC register snapshot to devcoredump

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] xe: NULL pointer dereference of `q` in devcoredump_snapshot()
--

commit e0032c5e9ffbf65f21b038440b113313907d9c4c
Author: Nareshkumar Gollakoti <naresh.kumar.g@intel.com>
Subject: drm/xe/devcoredump: Add GuC register snapshot to devcoredump

This commit adds support for capturing GuC register state as part of the xe
devcoredump snapshot. It defines a dedicated GuC register snapshot structure
and records selected GT and media GuC status/error registers.

> diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/xe_devcoredump.c
> index 1dbee725f55a1..f4a22e46eda78 100644
> --- a/drivers/gpu/drm/xe/xe_devcoredump.c
> +++ b/drivers/gpu/drm/xe/xe_devcoredump.c
[ ... ]
> @@ -561,6 +591,14 @@ static void devcoredump_snapshot(struct xe_devcoredump *coredump,
>  						      other_gt,
>  						      XE_DBG_REGSET_RPM,
>  						      XE_GT_TYPE_MEDIA);
> +	ss->gt_guc_reg = xe_dbg_gt_snapshot_capture(q->gt,
> +						    other_gt,
> +						    XE_DBG_REGSET_GUC,
> +						    XE_GT_TYPE_MAIN);

[Severity: High]
Can this cause a NULL pointer dereference when devcoredump_snapshot() is
called?

The xe_devcoredump_gt() function explicitly passes NULL for the q (exec queue)
parameter in cases like TLB invalidation timeouts, where the hang is not tied
to a specific queue.

If q is NULL, the unconditional access to q->gt here will trigger a kernel
panic during the error handling path, crashing the system and preventing the
devcoredump from successfully completing.

Would it be safer to use the provided gt argument instead of q->gt?

> +	ss->media_gt_guc_reg = xe_dbg_gt_snapshot_capture(q->gt,
> +							  other_gt,
> +							  XE_DBG_REGSET_GUC,
> +							  XE_GT_TYPE_MEDIA);

[Severity: High]
Similarly, does this unconditional access to q->gt risk a NULL pointer
dereference under the same conditions described above?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012145237.3788198-1-naresh.kumar.g@intel.com?part=2