drm/xe: Fix null pointer dereference in devcoredump cleanup

In xe_devcoredump_snapshot_free(), ss->gt may be NULL when the snapshot
was never fully populated (e.g., when cleanup is triggered without a
prior capture). Guard the xe_guc_capture_put_matched_nodes() call with
IS_ERR_OR_NULL() to prevent a null dereference.

In xe_devcoredump_free(), the deferred work is only queued when a
coredump is captured, so guard cancel_work_sync() with a check on
coredump->captured.

Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
Link: https://patch.msgid.link/20260326181017.2060209-1-zhanjun.dong@intel.com

diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/xe_devcoredump.c
index 558a1a9841a09c9cf3c71ef5609e144d30c0a3f8..ec206f512795d69cac21b3084a5cd0f545ba9079 100644 (file)
--- a/drivers/gpu/drm/xe/xe_devcoredump.c
+++ b/drivers/gpu/drm/xe/xe_devcoredump.c
@@ -149,7 +149,8 @@ static void xe_devcoredump_snapshot_free(struct xe_devcoredump_snapshot *ss)
        xe_guc_ct_snapshot_free(ss->guc.ct);
        ss->guc.ct = NULL;
 
-       xe_guc_capture_put_matched_nodes(&ss->gt->uc.guc);
+       if (!IS_ERR_OR_NULL(ss->gt))
+               xe_guc_capture_put_matched_nodes(&ss->gt->uc.guc);
        ss->matched_node = NULL;
 
        xe_guc_exec_queue_snapshot_free(ss->ge);
@@ -254,7 +255,8 @@ static void xe_devcoredump_free(void *data)
        if (!data || !coredump_to_xe(coredump))
                return;
 
-       cancel_work_sync(&coredump->snapshot.work);
+       if (coredump->captured)
+               cancel_work_sync(&coredump->snapshot.work);
 
        mutex_lock(&coredump->lock);