On 9/13/2026 6:52 AM, Slavin Liu wrote:
A negative response can be sent before crashdump state is assigned. If queuing that response fails, cleanup receives NULL. Treat that as no owned crashdump resources instead of dereferencing it.
Please describe the exact sequence of functions which triggers this scenario. I don't see it.
The change clearly protects against the ssr_crash parameter being NULL, but that doesn't occur in relation to queuing responses.
Detected by static analysis and reviewed with AI-assisted source auditing. Fixes: 6bc1fe6c748c ("accel/qaic: Collect crashdump from SSR channel") Assisted-by: LLM Signed-off-by: Slavin Liu <[email protected]> --- drivers/accel/qaic/qaic_ssr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/accel/qaic/qaic_ssr.c b/drivers/accel/qaic/qaic_ssr.c index a98928654959..d9ba1d333cdb 100644 --- a/drivers/accel/qaic/qaic_ssr.c +++ b/drivers/accel/qaic/qaic_ssr.c @@ -194,7 +194,11 @@ struct dump_file_meta {static void free_ssr_dump_info(struct ssr_crashdump *ssr_crash){ - struct ssr_dump_info *dump_info = ssr_crash->dump_info; + struct ssr_dump_info *dump_info; + + if (!ssr_crash) + return; + dump_info = ssr_crash->dump_info;ssr_crash->dump_info = NULL;if (!dump_info)
