All of lore.kernel.org
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Pan Chuang" <panchuang@vivo.com>
Cc: dri-devel@lists.freedesktop.org
Subject: Re: [PATCH 1/2] accel: ethosu: Remove redundant dev_err()
Date: Fri, 10 Jul 2026 11:06:50 +0000	[thread overview]
Message-ID: <20260710110650.C304E1F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260710105937.409992-2-panchuang@vivo.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Calling `drm_sched_fini()` after `drm_sched_init()` fails causes a kernel panic due to uninitialized structures.
--

--- Patch [1]: [PATCH 1/2] accel: ethosu: Remove redundant dev_err() ---
commit ab2aa317daa0785d0207a88d5d5b51fcef216f77
Author: Pan Chuang <panchuang@vivo.com>

accel: ethosu: Remove redundant dev_err()

This commit removes redundant driver-specific error logging after
devm_request_threaded_irq(), relying on the core IRQ code to automatically
log failures.

> diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethosu_job.c
> --- a/drivers/accel/ethosu/ethosu_job.c
> +++ b/drivers/accel/ethosu/ethosu_job.c
> @@ -338,10 +338,8 @@ int ethosu_job_init(struct ethosu_device *edev)
[ ... ]
> -	if (ret) {
> -		dev_err(dev, "failed to request irq\n");
> +	if (ret)
>  		return ret;
> -	}
>  
>  	edev->fence_context = dma_fence_context_alloc(1);

[Severity: High]
This is a pre-existing issue, but does the error handling path later in
ethosu_job_init() cause a kernel panic if drm_sched_init() fails?

If drm_sched_init() returns an error (for example, due to an out-of-memory
condition), the code jumps to the error label:

drivers/accel/ethosu/ethosu_job.c:ethosu_job_init() {
    ...
    ret = drm_sched_init(&edev->sched, &args);
    if (ret) {
        dev_err(dev, "Failed to create scheduler: %d\n", ret);
        goto err_sched;
    }
    ...
err_sched:
    drm_sched_fini(&edev->sched);
    return ret;
}

At this point, the job_scheduled waitqueue inside drm_gpu_scheduler remains
completely zero-initialized. When drm_sched_fini() attempts to wake up tasks
by calling wake_up_all(&sched->job_scheduled), the zero-initialized list_head
means its next pointer is NULL. The list_empty() check incorrectly returns
false, and the subsequent list iteration dereferences the NULL pointer.

Could this lead to an immediate panic during device probe failures?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710105937.409992-1-panchuang@vivo.com?part=1

  reply	other threads:[~2026-07-10 11:06 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-10 10:59 [PATCH 0/2] accel: Remove redundant error messages on IRQ request failure Pan Chuang
2026-07-10 10:59 ` [PATCH 1/2] accel: ethosu: Remove redundant dev_err() Pan Chuang
2026-07-10 11:06   ` sashiko-bot [this message]
2026-07-10 10:59 ` [PATCH 2/2] accel: rocket: " Pan Chuang
2026-07-10 11:09   ` sashiko-bot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260710110650.C304E1F000E9@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=panchuang@vivo.com \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.