Re: [PATCH v3 06/13] drm/panfrost: Explicitly enable MMU interrupts at device init

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Premature unmasking of MMU interrupts before reset workqueue initialization leads to a NULL pointer dereference.
--

--- Patch [6]: [PATCH v3 06/13] drm/panfrost: Explicitly enable MMU interrupts at device init ---
commit 28382212258245805fe4be63994981403a3d9c1c
Author: Adrián Larumbe <adrian.larumbe@collabora.com>

drm/panfrost: Explicitly enable MMU interrupts at device init

Because the device must be in a position to accept jobs between the time
drm_dev_register() is called and autosuspend first kicks in, there's a very
narrow window inbetween during which jobs targeting the tiler buffer
object would time out, since the device's PM status is 'Active', but no MMU
interrupts were enabled at device initialisation time.

> diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c
> index 4a3162c3b659f..bb6c1614964b1 100644
> --- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
> +++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c

[ ... ]

> @@ -970,6 +975,8 @@ int panfrost_mmu_init(struct panfrost_device *pfdev)
>  		return err;
>  	}
>  
> +	panfrost_mmu_enable_interrupts(pfdev);
> +

[Severity: High]
Could this premature unmasking of MMU interrupts lead to a NULL pointer
dereference during driver initialization?

If the GPU asserts an MMU interrupt (e.g., due to leftover state from the
bootloader or a hardware glitch) right after interrupts are enabled here, the
IRQ handler thread might encounter a fault and eventually attempt a reset.

However, the reset workqueue hasn't been allocated yet, because
panfrost_mmu_init() is called before panfrost_jm_init():

drivers/gpu/drm/panfrost/panfrost_device.c:panfrost_device_init() {
    ...
    err = panfrost_mmu_init(pfdev);
    if (err)
        goto out_gpu;

    err = panfrost_jm_init(pfdev);
    ...
}

If panfrost_mmu_irq_handler_thread() triggers a timeout in wait_ready(), it
will call panfrost_device_schedule_reset(), which assumes the reset
workqueue is already initialized:

drivers/gpu/drm/panfrost/panfrost_device.h:panfrost_device_schedule_reset() {
    ...
    queue_work(pfdev->reset.wq, &pfdev->reset.work);
}

Will this dereference the NULL pfdev->reset.wq pointer if the interrupt
fires before panfrost_jm_init() runs?

>  	return 0;
>  }
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724-claude-fixes-v3-0-542af61abd0f@collabora.com?part=6