Re: [PATCH v3] drm/xe/xe_devcoredump: Check NULL before dereferencing

["Souza, Jose" <jose.souza@intel.com>]

On Fri, 2024-03-22 at 09:28 +0530, Himal Prasad Ghimiray wrote:
> Dereference 'coredump' to access 'xe_devcoredump_snapshot' only if
> 'coredump' is not NULL,
> 
> v2
> - Fix commit messages.
> 
> v3
> - Define variables before code.(Ashutosh/Jose)
> 
> Cc: Ashutosh Dixit <ashutosh.dixit@intel.com>
> Cc: José Roberto de Souza <jose.souza@intel.com>
> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
> Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_devcoredump.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/xe_devcoredump.c
> index 7d3aa6bd3524..5b7be3b5b906 100644
> --- a/drivers/gpu/drm/xe/xe_devcoredump.c
> +++ b/drivers/gpu/drm/xe/xe_devcoredump.c
> @@ -77,17 +77,22 @@ static ssize_t xe_devcoredump_read(char *buffer, loff_t offset,
>  				   size_t count, void *data, size_t datalen)
>  {
>  	struct xe_devcoredump *coredump = data;
> -	struct xe_device *xe = coredump_to_xe(coredump);
> -	struct xe_devcoredump_snapshot *ss = &coredump->snapshot;
> +	struct xe_device *xe;
> +	struct xe_devcoredump_snapshot *ss;
>  	struct drm_printer p;
>  	struct drm_print_iterator iter;
>  	struct timespec64 ts;
>  	int i;
>  
> -	/* Our device is gone already... */
> -	if (!data || !coredump_to_xe(coredump))
> +	if (!coredump)
> +		return -ENODATA;
> +
> +	xe = coredump_to_xe(coredump);
> +	if (!xe)
>  		return -ENODEV;

this is real bug? because I can't see how this function is called with a null data.

if yes...

if coredump is not null this will never return -ENODEV.

would drop it and return ENODEV in the check above.

>  
> +	ss = &coredump->snapshot;
> +
>  	/* Ensure delayed work is captured before continuing */
>  	flush_work(&ss->work);
>