Re: [PATCH] drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked

[Matthew Brost <matthew.brost@intel.com>]

On Thu, Apr 09, 2026 at 12:34:49AM +0000, Shuicheng Lin wrote:
> xe_exec_queue_tlb_inval_last_fence_put_unlocked() uses q->vm->xe as the
> first argument to xe_assert(). This function is called unconditionally
> from xe_exec_queue_destroy() for all queues, including kernel queues
> that have q->vm == NULL (e.g., queues created during GT init in
> xe_gt_record_default_lrcs() with vm=NULL).
> 
> While current compilers optimize away the q->vm->xe dereference (even
> in CONFIG_DRM_XE_DEBUG=y builds, the compiler pushes the dereference
> into the WARN branch that is only taken when the assert condition is
> false), the code is semantically incorrect and constitutes undefined
> behavior in the C abstract machine for the NULL pointer case.
> 
> Use gt_to_xe(q->gt) instead, which is always valid for any exec queue.
> This is consistent with how xe_exec_queue_destroy() itself obtains the
> xe_device pointer in its own xe_assert at the top of the function.
> 
> Fixes: b2d7ec41f2a3 ("drm/xe: Attach last fence to TLB invalidation job queues")
> Cc: Matthew Brost <matthew.brost@intel.com>

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_exec_queue.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
> index 4603ff08d860..071b8c41df43 100644
> --- a/drivers/gpu/drm/xe/xe_exec_queue.c
> +++ b/drivers/gpu/drm/xe/xe_exec_queue.c
> @@ -1763,7 +1763,7 @@ void xe_exec_queue_tlb_inval_last_fence_put(struct xe_exec_queue *q,
>  void xe_exec_queue_tlb_inval_last_fence_put_unlocked(struct xe_exec_queue *q,
>  						     unsigned int type)
>  {
> -	xe_assert(q->vm->xe, type == XE_EXEC_QUEUE_TLB_INVAL_MEDIA_GT ||
> +	xe_assert(gt_to_xe(q->gt), type == XE_EXEC_QUEUE_TLB_INVAL_MEDIA_GT ||
>  		  type == XE_EXEC_QUEUE_TLB_INVAL_PRIMARY_GT);
>  
>  	dma_fence_put(q->tlb_inval[type].last_fence);
> -- 
> 2.43.0
>