Re: [PATCH v1 1/1] drm/xe: Fix null pointer dereference in devcoredump cleanup

["Belgaumkar, Vinay" <vinay.belgaumkar@intel.com>]

On 3/26/2026 11:10 AM, Zhanjun Dong wrote:
> In xe_devcoredump_snapshot_free(), ss->gt may be NULL when the snapshot
> was never fully populated (e.g., when cleanup is triggered without a
> prior capture). Guard the xe_guc_capture_put_matched_nodes() call with
> IS_ERR_OR_NULL() to prevent a null dereference.
>
> In xe_devcoredump_free(), the deferred work is only queued when a
> coredump is captured, so guard cancel_work_sync() with a check on
> coredump->captured.
>
> Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
> ---
>   drivers/gpu/drm/xe/xe_devcoredump.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/xe_devcoredump.c
> index 558a1a9841a0..ec206f512795 100644
> --- a/drivers/gpu/drm/xe/xe_devcoredump.c
> +++ b/drivers/gpu/drm/xe/xe_devcoredump.c
> @@ -149,7 +149,8 @@ static void xe_devcoredump_snapshot_free(struct xe_devcoredump_snapshot *ss)
>   	xe_guc_ct_snapshot_free(ss->guc.ct);
>   	ss->guc.ct = NULL;
>   
> -	xe_guc_capture_put_matched_nodes(&ss->gt->uc.guc);
> +	if (!IS_ERR_OR_NULL(ss->gt))
> +		xe_guc_capture_put_matched_nodes(&ss->gt->uc.guc);

How about the other pointers being used here? Like ss->guc and ss->ge?

Thanks,

Vinay.

>   	ss->matched_node = NULL;
>   
>   	xe_guc_exec_queue_snapshot_free(ss->ge);
> @@ -254,7 +255,8 @@ static void xe_devcoredump_free(void *data)
>   	if (!data || !coredump_to_xe(coredump))
>   		return;
>   
> -	cancel_work_sync(&coredump->snapshot.work);
> +	if (coredump->captured)
> +		cancel_work_sync(&coredump->snapshot.work);
>   
>   	mutex_lock(&coredump->lock);
>