Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Premature unmasking of MMU interrupts before reset workqueue initialization leads to a NULL pointer dereference. --
--- Patch [6]: [PATCH v3 06/13] drm/panfrost: Explicitly enable MMU interrupts at device init --- commit 28382212258245805fe4be63994981403a3d9c1c Author: Adrián Larumbe <[email protected]> drm/panfrost: Explicitly enable MMU interrupts at device init Because the device must be in a position to accept jobs between the time drm_dev_register() is called and autosuspend first kicks in, there's a very narrow window inbetween during which jobs targeting the tiler buffer object would time out, since the device's PM status is 'Active', but no MMU interrupts were enabled at device initialisation time. > diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c > b/drivers/gpu/drm/panfrost/panfrost_mmu.c > index 4a3162c3b659f..bb6c1614964b1 100644 > --- a/drivers/gpu/drm/panfrost/panfrost_mmu.c > +++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c [ ... ] > @@ -970,6 +975,8 @@ int panfrost_mmu_init(struct panfrost_device *pfdev) > return err; > } > > + panfrost_mmu_enable_interrupts(pfdev); > + [Severity: High] Could this premature unmasking of MMU interrupts lead to a NULL pointer dereference during driver initialization? If the GPU asserts an MMU interrupt (e.g., due to leftover state from the bootloader or a hardware glitch) right after interrupts are enabled here, the IRQ handler thread might encounter a fault and eventually attempt a reset. However, the reset workqueue hasn't been allocated yet, because panfrost_mmu_init() is called before panfrost_jm_init(): drivers/gpu/drm/panfrost/panfrost_device.c:panfrost_device_init() { ... err = panfrost_mmu_init(pfdev); if (err) goto out_gpu; err = panfrost_jm_init(pfdev); ... } If panfrost_mmu_irq_handler_thread() triggers a timeout in wait_ready(), it will call panfrost_device_schedule_reset(), which assumes the reset workqueue is already initialized: drivers/gpu/drm/panfrost/panfrost_device.h:panfrost_device_schedule_reset() { ... queue_work(pfdev->reset.wq, &pfdev->reset.work); } Will this dereference the NULL pfdev->reset.wq pointer if the interrupt fires before panfrost_jm_init() runs? > return 0; > } > -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=6
