Re: [PATCH v11 13/14] arm64: dts: rockchip: rk3576: add NPU (RKNN) nodes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Leaking `iommu_group` reference in `rocket_job_next_locked`.
--

commit 6d0158c8b1c151133b206dc57eb669f47d5dc64e
Author: Jiaxing Hu <gahing@gahingwoo.com>

arm64: dts: rockchip: rk3576: add NPU (RKNN) nodes

Add the two RKNN cores and their IOMMUs. Both cores are disabled by
default; boards enable what they wire up.

[Severity: High]
This isn't a bug introduced by this patch, but is there an iommu_group
reference leak in rocket_job_next_locked()?

drivers/accel/rocket/rocket_job.c:rocket_job_next_locked() {
...
	if (core->in_flight_job->next_task_idx < core->in_flight_job->task_count) {
		rocket_job_hw_submit(core, core->in_flight_job);
		return;
	}

	iommu_detach_group(NULL, iommu_group_get(core->dev));
	dma_fence_signal(core->in_flight_job->done_fence);
...
}

The reference acquired by iommu_group_get() is passed to
iommu_detach_group() which does not consume it. Since iommu_group_put()
is never called, this reference appears to leak.

Could this code use the already acquired core->iommu_group pointer instead?

> diff --git a/arch/arm64/boot/dts/rockchip/rk3576.dtsi b/arch/arm64/boot/dts/rockchip/rk3576.dtsi
> index b0c0d3c8b1b14..2d0133cdf9b5f 100644
> --- a/arch/arm64/boot/dts/rockchip/rk3576.dtsi
> +++ b/arch/arm64/boot/dts/rockchip/rk3576.dtsi

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831081956.84871-1-gahing@gahingwoo.com?part=13