Re: [PATCH] drm/xe: Fix NULL pointer dereference in xe_exec_ioctl

[Matthew Auld <matthew.auld@intel.com>]

On 17/12/2025 06:17, Tapani Pälli wrote:
> Helper function xe_sync_needs_wait expects sync->fence when accessing
> flags, patch makes sure we call only when sync->fence exists.
> 
> Fixes NULL pointer dereference seen with Vulkan workloads:
> 
> [  118.410401] RIP: 0010:xe_sync_needs_wait+0x27/0x50 [xe]
> 
> Fixes: 4ac9048d0501 ("drm/xe: Wait on in-syncs when swicthing to dma-fence mode")
> Signed-off-by: Tapani Pälli <tapani.palli@intel.com>
> ---
>   drivers/gpu/drm/xe/xe_exec.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_exec.c b/drivers/gpu/drm/xe/xe_exec.c
> index 730a5c9c2637..ea368f02cb9f 100644
> --- a/drivers/gpu/drm/xe/xe_exec.c
> +++ b/drivers/gpu/drm/xe/xe_exec.c
> @@ -184,7 +184,8 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
>   		if (xe_sync_is_ufence(&syncs[num_syncs]))
>   			num_ufence++;
>   
> -		if (!num_in_sync && xe_sync_needs_wait(&syncs[num_syncs]))
> +		if (!num_in_sync && syncs[num_syncs].fence &&
> +		    xe_sync_needs_wait(&syncs[num_syncs]))

In xe_sync_entry_parse() it looks like it will always populate the fence 
for the !signal case, otherwise throwing an error if that is not 
possible. And xe_sync_needs_wait() will only touch the fence if it's the 
signal case? So it seems like this should not be possible?

>   			num_in_sync++;
>   	}
>