]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
authorFrancois Dugast <francois.dugast@intel.com>
Tue, 16 Jun 2026 08:17:56 +0000 (10:17 +0200)
committerThomas Hellström <thomas.hellstrom@linux.intel.com>
Wed, 1 Jul 2026 16:01:10 +0000 (18:01 +0200)
commit3feeb667197bd58a17f4edfdbcad249ffcb3c864
tree23ee539a6be14aed43522386b25c3da903c0f95a
parentd42df9dce7b374079c5c41691bd62d8765768a80
drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()

The page-table walk framework may pass a NULL *child pointer for
unpopulated entries. xe_pt_zap_ptes_entry() called container_of(*child)
before checking for NULL, then dereferenced the result, causing a crash.

Move the container_of() call after a NULL guard, so the function returns
early instead of proceeding with an invalid pointer. XE_WARN_ON is kept
to help root cause the issue, but we now bail instead of crashing the
driver.

v2: Comment that triggering XE_WARN_ON is unexpected behavior (Matt Brost)

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20260616081756.286918-1-francois.dugast@intel.com
Signed-off-by: Francois Dugast <francois.dugast@intel.com>
(cherry picked from commit b9297d19d9df5d4b6c994648570c5dcd1cac68ff)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
drivers/gpu/drm/xe/xe_pt.c