Re: [PATCH] accel/qaic: tolerate absent crashdump state during cleanup

[Jeff Hugo]

On 9/13/2026 6:52 AM, Slavin Liu wrote:
> A negative response can be sent before crashdump state is assigned.
> If queuing that response fails, cleanup receives NULL. Treat that as
> no owned crashdump resources instead of dereferencing it.

Please describe the exact sequence of functions which triggers this 
scenario.  I don't see it.

The change clearly protects against the ssr_crash parameter being NULL, 
but that doesn't occur in relation to queuing responses.

> Detected by static analysis and reviewed with AI-assisted source auditing.
>
> Fixes: 6bc1fe6c748c ("accel/qaic: Collect crashdump from SSR channel")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <bolin.liu@xxxxxxxxxx>
> ---
>   drivers/accel/qaic/qaic_ssr.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/accel/qaic/qaic_ssr.c b/drivers/accel/qaic/qaic_ssr.c
> index a98928654959..d9ba1d333cdb 100644
> --- a/drivers/accel/qaic/qaic_ssr.c
> +++ b/drivers/accel/qaic/qaic_ssr.c
> @@ -194,7 +194,11 @@ struct dump_file_meta {
>   
>   static void free_ssr_dump_info(struct ssr_crashdump *ssr_crash)
>   {
> -	struct ssr_dump_info *dump_info = ssr_crash->dump_info;
> +	struct ssr_dump_info *dump_info;
> +
> +	if (!ssr_crash)
> +		return;
> +	dump_info = ssr_crash->dump_info;
>   
>   	ssr_crash->dump_info = NULL;
>   	if (!dump_info)