[PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[ming.qian]

From: Ming Qian <ming.qian@oss.nxp.com>

Fix a kernel panic when probing the driver as a module:

  Unable to handle kernel paging request at virtual address
  ffffd9c18eb05000
  of_find_matching_node_and_match+0x5c/0x1a0
  hantro_probe+0x2f4/0x7d0 [hantro_vpu]

The imx8mq_vpu_shared_resources array is referenced by variant
structures through their shared_devices field. When built as a
module, __initconst causes this data to be freed after module
init, but it's later accessed during probe, causing a page fault.

Use __initconst_or_module to keep the data available when built
as a module while still allowing it to be freed when built-in.

Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
---
 drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
index 6f8e43b7f157..fa429e6e8281 100644
--- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
@@ -343,7 +343,7 @@ const struct hantro_variant imx8mq_vpu_variant = {
 	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
 };
 
-static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
+static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst_or_module = {
 	{ .compatible = "nxp,imx8mq-vpu-g1", },
 	{ .compatible = "nxp,imx8mq-vpu-g2", },
 	{ /* sentinel */ }
-- 
2.52.0

Re: [PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[Marco Felsch]

Hi Ming,

On 26-03-05, ming.qian@oss.nxp.com wrote:
> From: Ming Qian <ming.qian@oss.nxp.com>
> 
> Fix a kernel panic when probing the driver as a module:
> 
>   Unable to handle kernel paging request at virtual address
>   ffffd9c18eb05000
>   of_find_matching_node_and_match+0x5c/0x1a0
>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> 
> The imx8mq_vpu_shared_resources array is referenced by variant
> structures through their shared_devices field. When built as a
> module, __initconst causes this data to be freed after module
> init, but it's later accessed during probe, causing a page fault.
> 
> Use __initconst_or_module to keep the data available when built
> as a module while still allowing it to be freed when built-in.

would be nice if I get at least some credit for pointing to the correct
fix ;)

> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>

However, patch looks fine:

Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>

> ---
>  drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> index 6f8e43b7f157..fa429e6e8281 100644
> --- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> +++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> @@ -343,7 +343,7 @@ const struct hantro_variant imx8mq_vpu_variant = {
>  	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
>  };
>  
> -static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
> +static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst_or_module = {
>  	{ .compatible = "nxp,imx8mq-vpu-g1", },
>  	{ .compatible = "nxp,imx8mq-vpu-g2", },
>  	{ /* sentinel */ }
> -- 
> 2.52.0
> 
> 

-- 
#gernperDu 
#CallMeByMyFirstName

Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |

Re: [PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[Ming Qian(OSS)]

Hi Marco,

On 3/5/2026 5:01 PM, Marco Felsch wrote:
> Hi Ming,
> 
> On 26-03-05, ming.qian@oss.nxp.com wrote:
>> From: Ming Qian <ming.qian@oss.nxp.com>
>>
>> Fix a kernel panic when probing the driver as a module:
>>
>>    Unable to handle kernel paging request at virtual address
>>    ffffd9c18eb05000
>>    of_find_matching_node_and_match+0x5c/0x1a0
>>    hantro_probe+0x2f4/0x7d0 [hantro_vpu]
>>
>> The imx8mq_vpu_shared_resources array is referenced by variant
>> structures through their shared_devices field. When built as a
>> module, __initconst causes this data to be freed after module
>> init, but it's later accessed during probe, causing a page fault.
>>
>> Use __initconst_or_module to keep the data available when built
>> as a module while still allowing it to be freed when built-in.
> 
> would be nice if I get at least some credit for pointing to the correct
> fix ;)

I'm sorry that I forget to add your Suggested-by tag.
I will include a Suggested-by tag in the next revision.
Appreciate your help.

Regards,
Ming

> 
>> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
>> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> 
> However, patch looks fine:
> 
> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
> 
>> ---
>>   drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
>> index 6f8e43b7f157..fa429e6e8281 100644
>> --- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
>> +++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
>> @@ -343,7 +343,7 @@ const struct hantro_variant imx8mq_vpu_variant = {
>>   	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
>>   };
>>   
>> -static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
>> +static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst_or_module = {
>>   	{ .compatible = "nxp,imx8mq-vpu-g1", },
>>   	{ .compatible = "nxp,imx8mq-vpu-g2", },
>>   	{ /* sentinel */ }
>> -- 
>> 2.52.0
>>
>>
> 

Re: [PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[Franz Schnyder]

Hi,

On Thu, Mar 05, 2026 at 04:03:52PM +0800, ming.qian@oss.nxp.com wrote:
> From: Ming Qian <ming.qian@oss.nxp.com>
> 
> Fix a kernel panic when probing the driver as a module:
> 
>   Unable to handle kernel paging request at virtual address
>   ffffd9c18eb05000
>   of_find_matching_node_and_match+0x5c/0x1a0
>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> 
> The imx8mq_vpu_shared_resources array is referenced by variant
> structures through their shared_devices field. When built as a
> module, __initconst causes this data to be freed after module
> init, but it's later accessed during probe, causing a page fault.
> 
> Use __initconst_or_module to keep the data available when built
> as a module while still allowing it to be freed when built-in.

Thanks for the fix. I tested it on our Verdin iMX8MP hardware.

Tested-by: Franz Schnyder <franz.schnyder@toradex.com>

Kind regards,
Franz

Re: [PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[Krzysztof Kozlowski]

On 05/03/2026 09:03, ming.qian@oss.nxp.com wrote:
> From: Ming Qian <ming.qian@oss.nxp.com>
> 
> Fix a kernel panic when probing the driver as a module:
> 
>   Unable to handle kernel paging request at virtual address
>   ffffd9c18eb05000
>   of_find_matching_node_and_match+0x5c/0x1a0
>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> 
> The imx8mq_vpu_shared_resources array is referenced by variant
> structures through their shared_devices field. When built as a
> module, __initconst causes this data to be freed after module
> init, but it's later accessed during probe, causing a page fault.
> 
> Use __initconst_or_module to keep the data available when built
> as a module while still allowing it to be freed when built-in.
> 
> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> ---
>  drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> index 6f8e43b7f157..fa429e6e8281 100644
> --- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> +++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> @@ -343,7 +343,7 @@ const struct hantro_variant imx8mq_vpu_variant = {
>  	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
>  };
>  
> -static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
> +static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst_or_module = {
>  	{ .compatible = "nxp,imx8mq-vpu-g1", },


I have some doubts this was tested with section mismatch analysis. It is
still referenced by non initconst data, but it should not. You have a
dangling pointer.

And build test would probably point it out.

Best regards,
Krzysztof

Re: [PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[Francesco Dolcini]

On Thu, Mar 05, 2026 at 04:03:52PM +0800, ming.qian@oss.nxp.com wrote:
> From: Ming Qian <ming.qian@oss.nxp.com>
> 
> Fix a kernel panic when probing the driver as a module:
> 
>   Unable to handle kernel paging request at virtual address
>   ffffd9c18eb05000
>   of_find_matching_node_and_match+0x5c/0x1a0
>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> 
> The imx8mq_vpu_shared_resources array is referenced by variant
> structures through their shared_devices field. When built as a
> module, __initconst causes this data to be freed after module
> init, but it's later accessed during probe, causing a page fault.
> 
> Use __initconst_or_module to keep the data available when built
> as a module while still allowing it to be freed when built-in.
> 
> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>

In addition to what Marco asked ...

Reported-by: Franz Schnyder <fra.schnyder@gmail.com>
Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/



Francesco

Re: [PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[Ming Qian(OSS)]

Hi,

On 3/5/2026 5:19 PM, Krzysztof Kozlowski wrote:
> On 05/03/2026 09:03, ming.qian@oss.nxp.com wrote:
>> From: Ming Qian <ming.qian@oss.nxp.com>
>>
>> Fix a kernel panic when probing the driver as a module:
>>
>>    Unable to handle kernel paging request at virtual address
>>    ffffd9c18eb05000
>>    of_find_matching_node_and_match+0x5c/0x1a0
>>    hantro_probe+0x2f4/0x7d0 [hantro_vpu]
>>
>> The imx8mq_vpu_shared_resources array is referenced by variant
>> structures through their shared_devices field. When built as a
>> module, __initconst causes this data to be freed after module
>> init, but it's later accessed during probe, causing a page fault.
>>
>> Use __initconst_or_module to keep the data available when built
>> as a module while still allowing it to be freed when built-in.
>>
>> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
>> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
>> ---
>>   drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
>> index 6f8e43b7f157..fa429e6e8281 100644
>> --- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
>> +++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
>> @@ -343,7 +343,7 @@ const struct hantro_variant imx8mq_vpu_variant = {
>>   	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
>>   };
>>   
>> -static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
>> +static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst_or_module = {
>>   	{ .compatible = "nxp,imx8mq-vpu-g1", },
> 
> 
> I have some doubts this was tested with section mismatch analysis. It is
> still referenced by non initconst data, but it should not. You have a
> dangling pointer.
> 
> And build test would probably point it out.

Thanks, that makes sense.

I'll remove the annotation and let it live in the normal .rodata
section.

An updated patch will follow.

Regards,
Ming
> 
> Best regards,
> Krzysztof
> 

Re: [PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[Krzysztof Kozlowski]

On 05/03/2026 10:01, Marco Felsch wrote:
> Hi Ming,
> 
> On 26-03-05, ming.qian@oss.nxp.com wrote:
>> From: Ming Qian <ming.qian@oss.nxp.com>
>>
>> Fix a kernel panic when probing the driver as a module:
>>
>>   Unable to handle kernel paging request at virtual address
>>   ffffd9c18eb05000
>>   of_find_matching_node_and_match+0x5c/0x1a0
>>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
>>
>> The imx8mq_vpu_shared_resources array is referenced by variant
>> structures through their shared_devices field. When built as a
>> module, __initconst causes this data to be freed after module
>> init, but it's later accessed during probe, causing a page fault.
>>
>> Use __initconst_or_module to keep the data available when built
>> as a module while still allowing it to be freed when built-in.
> 
> would be nice if I get at least some credit for pointing to the correct
> fix ;)
> 
>> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
>> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> 
> However, patch looks fine:
> 
> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>

Patch is not correct. This is being referenced from other data where
nothing is __init. Section mismatch might not point it, but I don't
think the code is readable and actually correct.

You can exercise it by rebinding device when built-in.

Best regards,
Krzysztof

Re: [PATCH] media: verisilicon: Fix kernel panic due to __initconst misuse

[Marco Felsch]

On 26-03-05, Krzysztof Kozlowski wrote:
> On 05/03/2026 10:01, Marco Felsch wrote:
> > Hi Ming,
> > 
> > On 26-03-05, ming.qian@oss.nxp.com wrote:
> >> From: Ming Qian <ming.qian@oss.nxp.com>
> >>
> >> Fix a kernel panic when probing the driver as a module:
> >>
> >>   Unable to handle kernel paging request at virtual address
> >>   ffffd9c18eb05000
> >>   of_find_matching_node_and_match+0x5c/0x1a0
> >>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> >>
> >> The imx8mq_vpu_shared_resources array is referenced by variant
> >> structures through their shared_devices field. When built as a
> >> module, __initconst causes this data to be freed after module
> >> init, but it's later accessed during probe, causing a page fault.
> >>
> >> Use __initconst_or_module to keep the data available when built
> >> as a module while still allowing it to be freed when built-in.
> > 
> > would be nice if I get at least some credit for pointing to the correct
> > fix ;)
> > 
> >> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> >> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> > 
> > However, patch looks fine:
> > 
> > Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
> 
> Patch is not correct. This is being referenced from other data where
> nothing is __init. Section mismatch might not point it, but I don't
> think the code is readable and actually correct.
> 
> You can exercise it by rebinding device when built-in.

That's correct, I didn't consider the manual unbind for the built-in
case in which you will trigger the issue again! Dropping the annotation
is the correct fix, thanks!

Regards,
  Marco


> 
> Best regards,
> Krzysztof
> 

-- 
#gernperDu 
#CallMeByMyFirstName

Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |