Hi Guangshuo, I have been working on this driver on RK3588 (Orange Pi 5 Plus) and went through your fix carefully:
- The analysis matches the code: rocket_probe() publishes the ERR_PTR into the file-scoped rdev before the IS_ERR() check, and since __driver_attach() keeps probing the remaining devices after a failed probe, the next rknn-core dereferences the poisoned pointer at rdev->num_cores. Every RK3588 DT carries three rknn-core nodes, so the follow-up probe is guaranteed. - rocket_device_init() cannot return -EPROBE_DEFER (it does no clock, regulator or supplier lookups), so clearing rdev here cannot interfere with the deferral path in rocket_core_init(), which already resets rdev correctly further down in rocket_probe(). - The fix mirrors the shape the driver already uses on the rocket_core_init() failure path (fini + rdev = NULL) and changes nothing on the success path. Reviewed-by: Igor Paunovic <[email protected]> I also ran the patched driver on RK3588: normal three-core probe, runtime PM suspend/resume and a Teflon/MobileNetV1 inference run are all unaffected. Thanks, Igor
