Re: [PATCH V1] accel/amdxdna: Fix potential NULL pointer access in amdxdna_gem_vmap()

[Max Zhen]

On 7/7/2026 Tue 10:23, Lizhi Hou wrote:

If the heap BO was never vmapped before its handle was closed and the
user then vmaps the dev BO (which triggers amdxdna_gem_vmap(heap_bo)),
and drm_gem_vmap fails — NULL pointer dereference at abo->client->xdna.

Fix it by get xdna pointer through to_xdna_dev(to_gobj(abo)->dev).

Fixes: d76856beb4a4 ("accel/amdxdna: Refactor GEM BO handling and add helper APIs 
for address retrieval")
Signed-off-by: Lizhi Hou <lizhi....@amd.com>

Reviewed-by: Max Zhen <max.z...@amd.com>

---
  drivers/accel/amdxdna/amdxdna_gem.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/amdxdna/amdxdna_gem.c 
b/drivers/accel/amdxdna/amdxdna_gem.c
index 64c7d82713b0..5033a0e5c6ab 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -198,6 +198,7 @@ amdxdna_gem_destroy_obj(struct amdxdna_gem_obj *abo)
   */
  void *amdxdna_gem_vmap(struct amdxdna_gem_obj *abo)
  {
+       struct amdxdna_dev *xdna = to_xdna_dev(to_gobj(abo)->dev);
        struct iosys_map map = IOSYS_MAP_INIT_VADDR(NULL);
        int ret;

@@ -210,7 +211,7 @@ void *amdxdna_gem_vmap(struct amdxdna_gem_obj *abo)

        if (!abo->mem.kva) {
                ret = drm_gem_vmap(to_gobj(abo), &map);
                if (ret)
-                       XDNA_ERR(abo->client->xdna, "Vmap bo failed, ret %d", 
ret);
+                       XDNA_ERR(xdna, "Vmap bo failed, ret %d", ret);
                else
                        abo->mem.kva = map.vaddr;
        }