Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] amdxdna: user-triggerable WARN_ON due to 0 dev_mem_size on NPU3 --
commit f86aaf866bc504bcba674227ac3b36c9902b057f Author: David Zhang <[email protected]> accel/amdxdna: Add NPU3 classic device support This commit adds NPU3 classic device operations, register definitions, PCI device IDs, and firmware declarations. It also guards device heap memory initialization against a zero-sized device heap, since NPU3 does not configure a dedicated device memory heap. > diff --git a/drivers/accel/amdxdna/npu3_regs.c > b/drivers/accel/amdxdna/npu3_regs.c > index 93f749acb5d5d..c82433d629012 100644 > --- a/drivers/accel/amdxdna/npu3_regs.c > +++ b/drivers/accel/amdxdna/npu3_regs.c [ ... ] > @@ -105,3 +105,17 @@ const struct amdxdna_dev_info dev_npu3_vf_info = { > .cert_feature_tbl = npu3_cert_feature_table, > .ops = &aie4_vf_ops, > }; > + > +const struct amdxdna_dev_info dev_npu3_classic_info = { > + .mbox_bar = NPU3_MBOX_BAR, [Severity: Medium] Since this struct leaves dev_mem_size uninitialized (defaults to 0), can this cause a user-triggerable WARN_ON? When an unprivileged user space client calls the DRM_IOCTL_AMDXDNA_CREATE_BO ioctl with args.type == AMDXDNA_BO_DEV_HEAP, the handler delegates to amdxdna_drm_create_dev_heap_bo() without verifying if the device actually supports a heap. In amdxdna_drm_create_dev_heap_bo(): WARN_ON(!is_power_of_2(xdna->dev_info->dev_mem_size)); Since dev_mem_size is 0, is_power_of_2(0) evaluates to false, causing the WARN_ON to execute. This allows any local user with DRM node access to flood the kernel log or potentially trigger a crash if panic_on_warn is enabled. > + .sram_bar = NPU3_MBOX_BUFFER_BAR, > + .psp_bar = NPU3_PSP_BAR_INDEX, > + .smu_bar = NPU3_SMU_BAR_INDEX, > + .doorbell_bar = NPU3_DOORBELL_BAR, > + .default_vbnv = "RyzenAI-npu3", > + .device_type = AMDXDNA_DEV_TYPE_UMQ, > + .dev_priv = &npu3_dev_priv, > + .fw_feature_tbl = npu3_fw_feature_table, > + .cert_feature_tbl = npu3_cert_feature_table, > + .ops = &aie4_classic_ops, > +}; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=5
