]> git.hungrycats.org Git - linux/commit
drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
authorFrancois Dugast <francois.dugast@intel.com>
Tue, 16 Jun 2026 08:17:56 +0000 (10:17 +0200)
committerFrancois Dugast <francois.dugast@intel.com>
Wed, 17 Jun 2026 07:48:49 +0000 (09:48 +0200)
commitb9297d19d9df5d4b6c994648570c5dcd1cac68ff
tree95a580ede85b3b5aee7aad1d00c305ef3b6d9c49
parent669252801a4aa4098fbc5dd9dd0bd93f0625abd7
drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()

The page-table walk framework may pass a NULL *child pointer for
unpopulated entries. xe_pt_zap_ptes_entry() called container_of(*child)
before checking for NULL, then dereferenced the result, causing a crash.

Move the container_of() call after a NULL guard, so the function returns
early instead of proceeding with an invalid pointer. XE_WARN_ON is kept
to help root cause the issue, but we now bail instead of crashing the
driver.

v2: Comment that triggering XE_WARN_ON is unexpected behavior (Matt Brost)

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20260616081756.286918-1-francois.dugast@intel.com
Signed-off-by: Francois Dugast <francois.dugast@intel.com>
drivers/gpu/drm/xe/xe_pt.c