From: Zhanjun Dong <zhanjun.dong@intel.com>
[ Upstream commit 12ef528d78adc8ea4e7e3db594f3bcac327e79fa ]
In xe_devcoredump_snapshot_free(), ss->gt may be NULL when the snapshot
was never fully populated (e.g., when cleanup is triggered without a
prior capture). Guard the xe_guc_capture_put_matched_nodes() call with
IS_ERR_OR_NULL() to prevent a null dereference.
In xe_devcoredump_free(), the deferred work is only queued when a
coredump is captured, so guard cancel_work_sync() with a check on
coredump->captured.
Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
Link: https://patch.msgid.link/20260326181017.2060209-1-zhanjun.dong@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
LLM Generated explanations, may be completely bogus:
The follow-up check completed: `git log` found no commits matching the
fix (`IS_ERR_OR_NULL(ss->gt)` or "devcoredump cleanup"), so it isn’t in
this tree yet. That matches the earlier read of `xe_devcoredump.c` — the
unconditional dereference and `cancel_work_sync()` are still there.
Backport recommendation remains **YES** for v6.18.43.
drivers/gpu/drm/xe/xe_devcoredump.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/xe_devcoredump.c
index 203e3038cc817..26a294f79e79f 100644
--- a/drivers/gpu/drm/xe/xe_devcoredump.c
+++ b/drivers/gpu/drm/xe/xe_devcoredump.c
@@ -150,7 +150,8 @@ static void xe_devcoredump_snapshot_free(struct xe_devcoredump_snapshot *ss)
xe_guc_ct_snapshot_free(ss->guc.ct);
ss->guc.ct = NULL;
- xe_guc_capture_put_matched_nodes(&ss->gt->uc.guc);
+ if (!IS_ERR_OR_NULL(ss->gt))
+ xe_guc_capture_put_matched_nodes(&ss->gt->uc.guc);
ss->matched_node = NULL;
xe_guc_exec_queue_snapshot_free(ss->ge);
@@ -255,7 +256,8 @@ static void xe_devcoredump_free(void *data)
if (!data || !coredump_to_xe(coredump))
return;
- cancel_work_sync(&coredump->snapshot.work);
+ if (coredump->captured)
+ cancel_work_sync(&coredump->snapshot.work);
mutex_lock(&coredump->lock);
--
2.53.0