Re: [PATCH v1 1/1] drm/xe: Fix null pointer dereference in devcoredump cleanup

["Dong, Zhanjun" <zhanjun.dong@intel.com>]

On 2026-04-01 4:57 p.m., Belgaumkar, Vinay wrote:
> 
> On 3/26/2026 11:10 AM, Zhanjun Dong wrote:
>> In xe_devcoredump_snapshot_free(), ss->gt may be NULL when the snapshot
>> was never fully populated (e.g., when cleanup is triggered without a
>> prior capture). Guard the xe_guc_capture_put_matched_nodes() call with
>> IS_ERR_OR_NULL() to prevent a null dereference.
>>
>> In xe_devcoredump_free(), the deferred work is only queued when a
>> coredump is captured, so guard cancel_work_sync() with a check on
>> coredump->captured.
>>
>> Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
>> ---
>>   drivers/gpu/drm/xe/xe_devcoredump.c | 6 ++++--
>>   1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/ 
>> xe_devcoredump.c
>> index 558a1a9841a0..ec206f512795 100644
>> --- a/drivers/gpu/drm/xe/xe_devcoredump.c
>> +++ b/drivers/gpu/drm/xe/xe_devcoredump.c
>> @@ -149,7 +149,8 @@ static void xe_devcoredump_snapshot_free(struct 
>> xe_devcoredump_snapshot *ss)
>>       xe_guc_ct_snapshot_free(ss->guc.ct);
>>       ss->guc.ct = NULL;
>> -    xe_guc_capture_put_matched_nodes(&ss->gt->uc.guc);
>> +    if (!IS_ERR_OR_NULL(ss->gt))
>> +        xe_guc_capture_put_matched_nodes(&ss->gt->uc.guc);
> 
> How about the other pointers being used here? Like ss->guc and ss->ge?
Thanks for take time to review.

For ss->guc, guc is embedded struct within xe_devcoredump_snapshot, so 
no null pointer risk.
For ss->ge, it can be null, the good part here is all functions (within 
this function) take this parameter already check for null internally, so 
no additional guard needed.
ss->gt is the only case.

Regards,
Zhanjun Dong
> 
> Thanks,
> 
> Vinay.
> 
>>       ss->matched_node = NULL;
>>       xe_guc_exec_queue_snapshot_free(ss->ge);
>> @@ -254,7 +255,8 @@ static void xe_devcoredump_free(void *data)
>>       if (!data || !coredump_to_xe(coredump))
>>           return;
>> -    cancel_work_sync(&coredump->snapshot.work);
>> +    if (coredump->captured)
>> +        cancel_work_sync(&coredump->snapshot.work);
>>       mutex_lock(&coredump->lock);