[PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[ming.qian]

From: Ming Qian <ming.qian@oss.nxp.com>

Fix a kernel panic when probing the driver as a module:

  Unable to handle kernel paging request at virtual address
  ffffd9c18eb05000
  of_find_matching_node_and_match+0x5c/0x1a0
  hantro_probe+0x2f4/0x7d0 [hantro_vpu]

The imx8mq_vpu_shared_resources array is referenced by variant
structures through their shared_devices field. When built as a
module, __initconst causes this data to be freed after module
init, but it's later accessed during probe, causing a page fault.

The imx8mq_vpu_shared_resources is referenced from non-init code,
so keeping __initconst or __initconst_or_module here is wrong.

Drop the __initconst annotation and let it live in the normal .rodata
section.

A bug of __initconst called from regular non-init probe code
leading to bugs during probe deferrals or during unbind-bind cycles.

Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
---
v4
- Increase the diff context length to pass the checkpatch.pl.
- Discard irrelevant changes to sentinel

v3
- Add missing Reported-by and Suggested-by tag
- Add commas to pass checkpatch

v2
- Remove __initconst
- Add missing Reported-by tag
- Add missing Suggested-by tag
- Remove comments of sentinel to pass checkpatch.pl

 drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
index 6f8e43b7f157..fa4224de4b99 100644
--- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
@@ -342,9 +342,9 @@ const struct hantro_variant imx8mq_vpu_variant = {
 	.reg_names = imx8mq_reg_names,
 	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
 };
 
-static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
+static const struct of_device_id imx8mq_vpu_shared_resources[] = {
 	{ .compatible = "nxp,imx8mq-vpu-g1", },
 	{ .compatible = "nxp,imx8mq-vpu-g2", },
 	{ /* sentinel */ }
 };

base-commit: f505e978d1a0442adbbde48aed38c084ddea6d6e
prerequisite-patch-id: 0000000000000000000000000000000000000000
-- 
2.52.0

Re: [PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Frank Li]

On Fri, Mar 06, 2026 at 11:10:57AM +0800, ming.qian@oss.nxp.com wrote:
> From: Ming Qian <ming.qian@oss.nxp.com>
>
> Fix a kernel panic when probing the driver as a module:
>
>   Unable to handle kernel paging request at virtual address
>   ffffd9c18eb05000
>   of_find_matching_node_and_match+0x5c/0x1a0
>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
>
> The imx8mq_vpu_shared_resources array is referenced by variant
> structures through their shared_devices field. When built as a
> module, __initconst causes this data to be freed after module
> init, but it's later accessed during probe, causing a page fault.
>
> The imx8mq_vpu_shared_resources is referenced from non-init code,
> so keeping __initconst or __initconst_or_module here is wrong.
>
> Drop the __initconst annotation and let it live in the normal .rodata
> section.
>
> A bug of __initconst called from regular non-init probe code
> leading to bugs during probe deferrals or during unbind-bind cycles.
>
> Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
> Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
> Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> v4
> - Increase the diff context length to pass the checkpatch.pl.
> - Discard irrelevant changes to sentinel
>
> v3
> - Add missing Reported-by and Suggested-by tag
> - Add commas to pass checkpatch
>
> v2
> - Remove __initconst
> - Add missing Reported-by tag
> - Add missing Suggested-by tag
> - Remove comments of sentinel to pass checkpatch.pl
>
>  drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> index 6f8e43b7f157..fa4224de4b99 100644
> --- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> +++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> @@ -342,9 +342,9 @@ const struct hantro_variant imx8mq_vpu_variant = {
>  	.reg_names = imx8mq_reg_names,
>  	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
>  };
>
> -static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
> +static const struct of_device_id imx8mq_vpu_shared_resources[] = {
>  	{ .compatible = "nxp,imx8mq-vpu-g1", },
>  	{ .compatible = "nxp,imx8mq-vpu-g2", },
>  	{ /* sentinel */ }
>  };
>
> base-commit: f505e978d1a0442adbbde48aed38c084ddea6d6e
> prerequisite-patch-id: 0000000000000000000000000000000000000000
> --
> 2.52.0
>

Re: [v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Ming Qian(OSS)]

On 3/6/2026 3:07 PM, Patchwork Integration wrote:
> Dear Ming Qian(OSS):
> 
> Thanks for your patches! Unfortunately the Media CI robot detected some
> issues:
> 
> # Test checkpatch:./0001-media-verisilicon-Fix-kernel-panic-due-to-__initcons.patch checkpatch
> ERROR: missing sentinel in ID array
> #51: FILE: drivers/media/platform/verisilicon/imx8m_vpu_hw.c:346:
> +static const struct of_device_id imx8mq_vpu_shared_resources[] = {
>   { .compatible = "XXXXXXXXXXXXXXXXX", },
>   { .compatible = "XXXXXXXXXXXXXXXXX", },
>   {  }
> 
> 
> total: 1 errors, 0 warnings, 0 checks, 8 lines checked
> 

checkpatch false positive: sentinel present but outside diff context,
If the diff context is one line longer, running `checkpatch.pl` will pass.

Regards,
Ming

> 
> 
> Please fix your series, and upload a new version. If you have a patchwork
> account, do not forget to mark the current series as Superseded.
> 
> For more details, check the full report at:
> https://linux-media.pages.freedesktop.org/-/users/patchwork/-/jobs/94619357/artifacts/report.htm .
> 
> 
> 
> Best regards, and Happy Hacking!
> Media CI robot on behalf of the linux-media community.
> 
> ---
> Check the latest rules for contributing your patches at:
> https://docs.kernel.org/driver-api/media/maintainer-entry-profile.html
> 
> If you believe that the CI is wrong, kindly open an issue at
> https://gitlab.freedesktop.org/linux-media/media-ci/-/issues or reply-all
> to this message.
> 

Re: [PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Francesco Dolcini]

Hello,

On Fri, Mar 06, 2026 at 11:10:57AM +0800, ming.qian@oss.nxp.com wrote:
> From: Ming Qian <ming.qian@oss.nxp.com>
> 
> Fix a kernel panic when probing the driver as a module:
> 
>   Unable to handle kernel paging request at virtual address
>   ffffd9c18eb05000
>   of_find_matching_node_and_match+0x5c/0x1a0
>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> 
> The imx8mq_vpu_shared_resources array is referenced by variant
> structures through their shared_devices field. When built as a
> module, __initconst causes this data to be freed after module
> init, but it's later accessed during probe, causing a page fault.
> 
> The imx8mq_vpu_shared_resources is referenced from non-init code,
> so keeping __initconst or __initconst_or_module here is wrong.
> 
> Drop the __initconst annotation and let it live in the normal .rodata
> section.
> 
> A bug of __initconst called from regular non-init probe code
> leading to bugs during probe deferrals or during unbind-bind cycles.
> 
> Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
> Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
> Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>

What's the plan to merge this? It fixes a quite severe regression,
a boot failure.

#regzbot introduced: e0203ddf9af7

Thanks,
Francesco

Re: [PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Nicolas Dufresne]

[-- Attachment #1: Type: text/plain, Size: 2287 bytes --]

Le jeudi 12 mars 2026 à 18:34 +0100, Francesco Dolcini a écrit :
> Hello,
> 
> On Fri, Mar 06, 2026 at 11:10:57AM +0800, ming.qian@oss.nxp.com wrote:
> > From: Ming Qian <ming.qian@oss.nxp.com>
> > 
> > Fix a kernel panic when probing the driver as a module:
> > 
> >   Unable to handle kernel paging request at virtual address
> >   ffffd9c18eb05000
> >   of_find_matching_node_and_match+0x5c/0x1a0
> >   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> > 
> > The imx8mq_vpu_shared_resources array is referenced by variant
> > structures through their shared_devices field. When built as a
> > module, __initconst causes this data to be freed after module
> > init, but it's later accessed during probe, causing a page fault.
> > 
> > The imx8mq_vpu_shared_resources is referenced from non-init code,
> > so keeping __initconst or __initconst_or_module here is wrong.
> > 
> > Drop the __initconst annotation and let it live in the normal .rodata
> > section.
> > 
> > A bug of __initconst called from regular non-init probe code
> > leading to bugs during probe deferrals or during unbind-bind cycles.
> > 
> > Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> > Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
> > Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
> > Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
> > Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> > Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> > Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
> > Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
> > Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> 
> What's the plan to merge this? It fixes a quite severe regression,
> a boot failure.

To be decided this week. The commit message does not say if it was released, or
came in RCs (and I didn't check myself yet). I'd say, if its the first one, it
will go through next and backports, otherwise its is really tight to get that
into the RC series, but serious enough. Please fill the gap if you have time,
and I'll handle it later, probably tomorrow.

Nicolas

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Thorsten Leemhuis]

On 3/16/26 16:25, Nicolas Dufresne wrote:
> Le jeudi 12 mars 2026 à 18:34 +0100, Francesco Dolcini a écrit :
>> On Fri, Mar 06, 2026 at 11:10:57AM +0800, ming.qian@oss.nxp.com wrote:
>>> From: Ming Qian <ming.qian@oss.nxp.com>
>>>
>>> Fix a kernel panic when probing the driver as a module:
>>>
>>>   Unable to handle kernel paging request at virtual address
>>>   ffffd9c18eb05000
>>>   of_find_matching_node_and_match+0x5c/0x1a0
>>>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
>>>
>>> The imx8mq_vpu_shared_resources array is referenced by variant
>>> structures through their shared_devices field. When built as a
>>> module, __initconst causes this data to be freed after module
>>> init, but it's later accessed during probe, causing a page fault.
>>>
>>> The imx8mq_vpu_shared_resources is referenced from non-init code,
>>> so keeping __initconst or __initconst_or_module here is wrong.
>>>
>>> Drop the __initconst annotation and let it live in the normal .rodata
>>> section.
>>>
>>> A bug of __initconst called from regular non-init probe code
>>> leading to bugs during probe deferrals or during unbind-bind cycles.
>>>
>>> Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
>>> Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
>>> Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
>>> Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
>>> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
>>> Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
>>> Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
>>> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
>>> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
>>
>> What's the plan to merge this? It fixes a quite severe regression,
>> a boot failure.
> 
> To be decided this week. The commit message does not say if it was released, or
> came in RCs (and I didn't check myself yet). I'd say, if its the first one, it
> will go through next and backports, otherwise its is really tight to get that
> into the RC series, but serious enough. Please fill the gap if you have time,
> and I'll handle it later, probably tomorrow.

Well, FYI: the culprit according to the fixes tag quoted above is
e0203ddf9af7c8 ("media: verisilicon: Avoid G2 bus error while decoding
H.264 and HEVC") [v7.0-rc1, v6.19.6 (286d629d10640b)]. Given that this was
* reported 11 days ago
* reported at least two times
* made it into a stable series
it is something that Linus would like to see fixed by now in mainline
afaics, as ""the rule of thumb should generally be "within a week",
preferably before the next rc."":
https://www.kernel.org/doc/html/next/process/handling-regressions.html#on-how-quickly-regressions-should-be-fixed

If that fix is too dangerous a revert is of course an option, too.

BTW, given that the culprit made it to a stable series, it would be a
wise to add a stable tag to ensure it's backported (it otherweise might
be silent dropped and/or applying might be deferred).

Ciao, Thorsten

Re: [PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Francesco Dolcini]

On Mon, Mar 16, 2026 at 11:25:53AM -0400, Nicolas Dufresne wrote:
> Le jeudi 12 mars 2026 à 18:34 +0100, Francesco Dolcini a écrit :
> > Hello,
> > 
> > On Fri, Mar 06, 2026 at 11:10:57AM +0800, ming.qian@oss.nxp.com wrote:
> > > From: Ming Qian <ming.qian@oss.nxp.com>
> > > 
> > > Fix a kernel panic when probing the driver as a module:
> > > 
> > >   Unable to handle kernel paging request at virtual address
> > >   ffffd9c18eb05000
> > >   of_find_matching_node_and_match+0x5c/0x1a0
> > >   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> > > 
> > > The imx8mq_vpu_shared_resources array is referenced by variant
> > > structures through their shared_devices field. When built as a
> > > module, __initconst causes this data to be freed after module
> > > init, but it's later accessed during probe, causing a page fault.
> > > 
> > > The imx8mq_vpu_shared_resources is referenced from non-init code,
> > > so keeping __initconst or __initconst_or_module here is wrong.
> > > 
> > > Drop the __initconst annotation and let it live in the normal .rodata
> > > section.
> > > 
> > > A bug of __initconst called from regular non-init probe code
> > > leading to bugs during probe deferrals or during unbind-bind cycles.
> > > 
> > > Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> > > Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
> > > Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
> > > Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
> > > Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> > > Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> > > Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
> > > Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
> > > Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> > 
> > What's the plan to merge this? It fixes a quite severe regression,
> > a boot failure.
> 
> To be decided this week. The commit message does not say if it was released, or
> came in RCs (and I didn't check myself yet). I'd say, if its the first one, it
> will go through next and backports, otherwise its is really tight to get that
> into the RC series, but serious enough. Please fill the gap if you have time,
> and I'll handle it later, probably tomorrow.

This fixes commit e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error
while decoding H.264 and HEVC"), that was merged in 7.0-rc1.

As of now, because of that, 7.0-rc is not booting on affected platforms
(i.MX8MP), to me this needs to get merged before 7.0 is released.

Francesco

Re: [PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Francesco Dolcini]

On Mon, Mar 16, 2026 at 04:56:09PM +0100, Thorsten Leemhuis wrote:
> On 3/16/26 16:25, Nicolas Dufresne wrote:
> > Le jeudi 12 mars 2026 à 18:34 +0100, Francesco Dolcini a écrit :
> >> On Fri, Mar 06, 2026 at 11:10:57AM +0800, ming.qian@oss.nxp.com wrote:
> >>> From: Ming Qian <ming.qian@oss.nxp.com>
> >>>
> >>> Fix a kernel panic when probing the driver as a module:
> >>>
> >>>   Unable to handle kernel paging request at virtual address
> >>>   ffffd9c18eb05000
> >>>   of_find_matching_node_and_match+0x5c/0x1a0
> >>>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> >>>
> >>> The imx8mq_vpu_shared_resources array is referenced by variant
> >>> structures through their shared_devices field. When built as a
> >>> module, __initconst causes this data to be freed after module
> >>> init, but it's later accessed during probe, causing a page fault.
> >>>
> >>> The imx8mq_vpu_shared_resources is referenced from non-init code,
> >>> so keeping __initconst or __initconst_or_module here is wrong.
> >>>
> >>> Drop the __initconst annotation and let it live in the normal .rodata
> >>> section.
> >>>
> >>> A bug of __initconst called from regular non-init probe code
> >>> leading to bugs during probe deferrals or during unbind-bind cycles.
> >>>
> >>> Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> >>> Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
> >>> Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
> >>> Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
> >>> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> >>> Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> >>> Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
> >>> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
> >>> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> >>
> >> What's the plan to merge this? It fixes a quite severe regression,
> >> a boot failure.
> > 
> > To be decided this week. The commit message does not say if it was released, or
> > came in RCs (and I didn't check myself yet). I'd say, if its the first one, it
> > will go through next and backports, otherwise its is really tight to get that
> > into the RC series, but serious enough. Please fill the gap if you have time,
> > and I'll handle it later, probably tomorrow.
> 
> Well, FYI: the culprit according to the fixes tag quoted above is
> e0203ddf9af7c8 ("media: verisilicon: Avoid G2 bus error while decoding
> H.264 and HEVC") [v7.0-rc1, v6.19.6 (286d629d10640b)]. Given that this was
> * reported 11 days ago
> * reported at least two times
> * made it into a stable series
> it is something that Linus would like to see fixed by now in mainline
> afaics, as ""the rule of thumb should generally be "within a week",
> preferably before the next rc."":
> https://www.kernel.org/doc/html/next/process/handling-regressions.html#on-how-quickly-regressions-should-be-fixed
> 
> If that fix is too dangerous a revert is of course an option, too.
> 
> BTW, given that the culprit made it to a stable series, it would be a
> wise to add a stable tag to ensure it's backported (it otherweise might
> be silent dropped and/or applying might be deferred).

Absolutely ... the tag here should help b4

Cc: stable@vger.kernel.org

Francesco

Re: [PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Krzysztof Kozlowski]

On 16/03/2026 16:25, Nicolas Dufresne wrote:
> Le jeudi 12 mars 2026 à 18:34 +0100, Francesco Dolcini a écrit :
>> Hello,
>>
>> On Fri, Mar 06, 2026 at 11:10:57AM +0800, ming.qian@oss.nxp.com wrote:
>>> From: Ming Qian <ming.qian@oss.nxp.com>
>>>
>>> Fix a kernel panic when probing the driver as a module:
>>>
>>>   Unable to handle kernel paging request at virtual address
>>>   ffffd9c18eb05000
>>>   of_find_matching_node_and_match+0x5c/0x1a0
>>>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
>>>
>>> The imx8mq_vpu_shared_resources array is referenced by variant
>>> structures through their shared_devices field. When built as a
>>> module, __initconst causes this data to be freed after module
>>> init, but it's later accessed during probe, causing a page fault.
>>>
>>> The imx8mq_vpu_shared_resources is referenced from non-init code,
>>> so keeping __initconst or __initconst_or_module here is wrong.
>>>
>>> Drop the __initconst annotation and let it live in the normal .rodata
>>> section.
>>>
>>> A bug of __initconst called from regular non-init probe code
>>> leading to bugs during probe deferrals or during unbind-bind cycles.
>>>
>>> Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
>>> Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
>>> Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
>>> Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
>>> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
>>> Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
>>> Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
>>> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
>>> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
>>
>> What's the plan to merge this? It fixes a quite severe regression,
>> a boot failure.
> 
> To be decided this week. The commit message does not say if it was released, or
> came in RCs (and I didn't check myself yet). I'd say, if its the first one, it
> will go through next and backports, otherwise its is really tight to get that
> into the RC series, but serious enough. Please fill the gap if you have time,
> and I'll handle it later, probably tomorrow.

As Francesco pointed and earlier Franz, this affects current users so
please consider bigger impact of the issue and applying as soon as you
have time (I know you have many patches).

To help:

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>

Best regards,
Krzysztof

Re: [PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Nicolas Dufresne]

[-- Attachment #1: Type: text/plain, Size: 3142 bytes --]

Le lundi 16 mars 2026 à 16:57 +0100, Francesco Dolcini a écrit :
> On Mon, Mar 16, 2026 at 11:25:53AM -0400, Nicolas Dufresne wrote:
> > Le jeudi 12 mars 2026 à 18:34 +0100, Francesco Dolcini a écrit :
> > > Hello,
> > > 
> > > On Fri, Mar 06, 2026 at 11:10:57AM +0800, ming.qian@oss.nxp.com wrote:
> > > > From: Ming Qian <ming.qian@oss.nxp.com>
> > > > 
> > > > Fix a kernel panic when probing the driver as a module:
> > > > 
> > > >   Unable to handle kernel paging request at virtual address
> > > >   ffffd9c18eb05000
> > > >   of_find_matching_node_and_match+0x5c/0x1a0
> > > >   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> > > > 
> > > > The imx8mq_vpu_shared_resources array is referenced by variant
> > > > structures through their shared_devices field. When built as a
> > > > module, __initconst causes this data to be freed after module
> > > > init, but it's later accessed during probe, causing a page fault.
> > > > 
> > > > The imx8mq_vpu_shared_resources is referenced from non-init code,
> > > > so keeping __initconst or __initconst_or_module here is wrong.
> > > > 
> > > > Drop the __initconst annotation and let it live in the normal .rodata
> > > > section.
> > > > 
> > > > A bug of __initconst called from regular non-init probe code
> > > > leading to bugs during probe deferrals or during unbind-bind cycles.
> > > > 
> > > > Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> > > > Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
> > > > Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
> > > > Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
> > > > Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> > > > Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> > > > Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
> > > > Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
> > > > Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> > > 
> > > What's the plan to merge this? It fixes a quite severe regression,
> > > a boot failure.
> > 
> > To be decided this week. The commit message does not say if it was released, or
> > came in RCs (and I didn't check myself yet). I'd say, if its the first one, it
> > will go through next and backports, otherwise its is really tight to get that
> > into the RC series, but serious enough. Please fill the gap if you have time,
> > and I'll handle it later, probably tomorrow.
> 
> This fixes commit e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error
> while decoding H.264 and HEVC"), that was merged in 7.0-rc1.
> 
> As of now, because of that, 7.0-rc is not booting on affected platforms
> (i.MX8MP), to me this needs to get merged before 7.0 is released.

Thanks for the info (thanks Thorsten too, pointing out it got picked for
backport into 6.19). This saves me a bit of time, I was away all week last week.

So this will be picked for RC, I should have it sent to Mauro by tomorrow.

regards,
Nicolas

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v4] media: verisilicon: Fix kernel panic due to __initconst misuse

[Nicolas Dufresne]

On Fri, 06 Mar 2026 11:10:57 +0800, ming.qian@oss.nxp.com wrote:
> Fix a kernel panic when probing the driver as a module:
> 
>   Unable to handle kernel paging request at virtual address
>   ffffd9c18eb05000
>   of_find_matching_node_and_match+0x5c/0x1a0
>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> 
> [...]

PR sent to Mauro aiming for RC5, thanks!

[1/1] media: verisilicon: Fix kernel panic due to __initconst misuse
      commit: ab2e204b1e76e1a85ff75592dcbfefa3d783a683

Best regards,
-- 
Nicolas Dufresne <nicolas.dufresne@collabora.com>