Re: [PATCH v2] drm/xe: Fix NULL pointer dereference in xe_exec_ioctl

[Matthew Auld <matthew.auld@intel.com>]

On 17/12/2025 12:32, Tapani Pälli wrote:
> Helper function xe_sync_needs_wait expects sync->fence when accessing
> flags, patch makes sure we call only when sync->fence exists.
> 
> v2: move null checking to xe_sync_needs_wait and make
>      xe_sync_entry_wait utilize this helper (Matthew Auld)
> 
> Fixes NULL pointer dereference seen with Vulkan workloads:
> 
> [  118.410401] RIP: 0010:xe_sync_needs_wait+0x27/0x50 [xe]
> 
> Fixes: 4ac9048d0501 ("drm/xe: Wait on in-syncs when swicthing to dma-fence mode")
> Signed-off-by: Tapani Pälli <tapani.palli@intel.com>
> ---
>   drivers/gpu/drm/xe/xe_sync.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_sync.c b/drivers/gpu/drm/xe/xe_sync.c
> index ee1344a880b9..2b6c2e2527ae 100644
> --- a/drivers/gpu/drm/xe/xe_sync.c
> +++ b/drivers/gpu/drm/xe/xe_sync.c
> @@ -241,7 +241,8 @@ int xe_sync_entry_wait(struct xe_sync_entry *sync)
>   	if (sync->flags & DRM_XE_SYNC_FLAG_SIGNAL)
>   		return 0;

^^ I think we can drop this bit, since below will now check it?

>   
> -	return dma_fence_wait(sync->fence, true);
> +	return xe_sync_needs_wait(sync) ?
> +		dma_fence_wait(sync->fence, true) : 0;
>   }
>   
>   /**
> @@ -252,7 +253,7 @@ int xe_sync_entry_wait(struct xe_sync_entry *sync)
>    */
>   bool xe_sync_needs_wait(struct xe_sync_entry *sync)
>   {
> -	return !(sync->flags & DRM_XE_SYNC_FLAG_SIGNAL) &&
> +	return !(sync->flags & DRM_XE_SYNC_FLAG_SIGNAL) && sync->fence &&
>   		!test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &sync->fence->flags);

Here I think we can maybe simplify:

sync->fence && !test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &sync->fence->flags)

Since sync->fence != NULL must imply an in-fence which will always be 
!signal for the flags anyway?

>   }
>