Re: [PATCH v3] drm/xe/xe_devcoredump: Check NULL before dereferencing

[Rodrigo Vivi <rodrigo.vivi@intel.com>]

On Fri, Mar 22, 2024 at 09:57:32AM -0400, Souza, Jose wrote:
> On Fri, 2024-03-22 at 09:28 +0530, Himal Prasad Ghimiray wrote:
> > Dereference 'coredump' to access 'xe_devcoredump_snapshot' only if
> > 'coredump' is not NULL,
> > 
> > v2
> > - Fix commit messages.
> > 
> > v3
> > - Define variables before code.(Ashutosh/Jose)
> > 
> > Cc: Ashutosh Dixit <ashutosh.dixit@intel.com>
> > Cc: José Roberto de Souza <jose.souza@intel.com>
> > Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
> > Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> > Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
> > ---
> >  drivers/gpu/drm/xe/xe_devcoredump.c | 13 +++++++++----
> >  1 file changed, 9 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/xe_devcoredump.c
> > index 7d3aa6bd3524..5b7be3b5b906 100644
> > --- a/drivers/gpu/drm/xe/xe_devcoredump.c
> > +++ b/drivers/gpu/drm/xe/xe_devcoredump.c
> > @@ -77,17 +77,22 @@ static ssize_t xe_devcoredump_read(char *buffer, loff_t offset,
> >  				   size_t count, void *data, size_t datalen)
> >  {
> >  	struct xe_devcoredump *coredump = data;
> > -	struct xe_device *xe = coredump_to_xe(coredump);
> > -	struct xe_devcoredump_snapshot *ss = &coredump->snapshot;
> > +	struct xe_device *xe;
> > +	struct xe_devcoredump_snapshot *ss;
> >  	struct drm_printer p;
> >  	struct drm_print_iterator iter;
> >  	struct timespec64 ts;
> >  	int i;
> >  
> > -	/* Our device is gone already... */
> > -	if (!data || !coredump_to_xe(coredump))
> > +	if (!coredump)
> > +		return -ENODATA;
> > +
> > +	xe = coredump_to_xe(coredump);
> > +	if (!xe)
> >  		return -ENODEV;
> 
> this is real bug? because I can't see how this function is called with a null data.
> 
> if yes...
> 
> if coredump is not null this will never return -ENODEV.
> 
> would drop it and return ENODEV in the check above.

yeap, very good point

this patch could be simply a 2 line patch:

- if (!data || !coredump_to_xe(coredump))
+ if (!coredump_to_xe(coredump))

we are happy and the static analyzer is happy

> 
> >  
> > +	ss = &coredump->snapshot;
> > +
> >  	/* Ensure delayed work is captured before continuing */
> >  	flush_work(&ss->work);
> >  
>