[PATCH] accel/qaic: tolerate absent crashdump state during cleanup

[PATCH] accel/qaic: tolerate absent crashdump state during cleanup

[Slavin Liu]

A negative response can be sent before crashdump state is assigned.
If queuing that response fails, cleanup receives NULL. Treat that as
no owned crashdump resources instead of dereferencing it.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: 6bc1fe6c748c ("accel/qaic: Collect crashdump from SSR channel")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
---
 drivers/accel/qaic/qaic_ssr.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/qaic/qaic_ssr.c b/drivers/accel/qaic/qaic_ssr.c
index a98928654959..d9ba1d333cdb 100644
--- a/drivers/accel/qaic/qaic_ssr.c
+++ b/drivers/accel/qaic/qaic_ssr.c
@@ -194,7 +194,11 @@ struct dump_file_meta {
 
 static void free_ssr_dump_info(struct ssr_crashdump *ssr_crash)
 {
-	struct ssr_dump_info *dump_info = ssr_crash->dump_info;
+	struct ssr_dump_info *dump_info;
+
+	if (!ssr_crash)
+		return;
+	dump_info = ssr_crash->dump_info;
 
 	ssr_crash->dump_info = NULL;
 	if (!dump_info)

Re: [PATCH] accel/qaic: tolerate absent crashdump state during cleanup

[Jeff Hugo]

On 9/13/2026 6:52 AM, Slavin Liu wrote:
> A negative response can be sent before crashdump state is assigned.
> If queuing that response fails, cleanup receives NULL. Treat that as
> no owned crashdump resources instead of dereferencing it.

Please describe the exact sequence of functions which triggers this 
scenario.  I don't see it.

The change clearly protects against the ssr_crash parameter being NULL, 
but that doesn't occur in relation to queuing responses.

> Detected by static analysis and reviewed with AI-assisted source auditing.
> 
> Fixes: 6bc1fe6c748c ("accel/qaic: Collect crashdump from SSR channel")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
> ---
>   drivers/accel/qaic/qaic_ssr.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/accel/qaic/qaic_ssr.c b/drivers/accel/qaic/qaic_ssr.c
> index a98928654959..d9ba1d333cdb 100644
> --- a/drivers/accel/qaic/qaic_ssr.c
> +++ b/drivers/accel/qaic/qaic_ssr.c
> @@ -194,7 +194,11 @@ struct dump_file_meta {
>   
>   static void free_ssr_dump_info(struct ssr_crashdump *ssr_crash)
>   {
> -	struct ssr_dump_info *dump_info = ssr_crash->dump_info;
> +	struct ssr_dump_info *dump_info;
> +
> +	if (!ssr_crash)
> +		return;
> +	dump_info = ssr_crash->dump_info;
>   
>   	ssr_crash->dump_info = NULL;
>   	if (!dump_info)