Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] amdxdna: user-triggerable WARN_ON via AMDXDNA_BO_DEV_HEAP on NPU3 classic --
commit 9daa4537d3513c6a4bc057f8afd01b65162be2b6 Author: David Zhang <[email protected]> accel/amdxdna: Add NPU3 classic device support Add NPU3 classic device operations (aie4_classic_ops) and register definitions, as well as the PCI device ID and firmware declarations for NPU3 classic devices. Remove device IDs 0x1B0B and 0x1B0C because those devices will not be released. > diff --git a/drivers/accel/amdxdna/npu3_regs.c > b/drivers/accel/amdxdna/npu3_regs.c > index 93f749acb5d5d..c82433d629012 100644 > --- a/drivers/accel/amdxdna/npu3_regs.c > +++ b/drivers/accel/amdxdna/npu3_regs.c > @@ -105,3 +105,17 @@ const struct amdxdna_dev_info dev_npu3_vf_info = { > .cert_feature_tbl = npu3_cert_feature_table, > .ops = &aie4_vf_ops, > }; > + > +const struct amdxdna_dev_info dev_npu3_classic_info = { > + .mbox_bar = NPU3_MBOX_BAR, > + .sram_bar = NPU3_MBOX_BUFFER_BAR, > + .psp_bar = NPU3_PSP_BAR_INDEX, > + .smu_bar = NPU3_SMU_BAR_INDEX, > + .doorbell_bar = NPU3_DOORBELL_BAR, > + .default_vbnv = "RyzenAI-npu3", > + .device_type = AMDXDNA_DEV_TYPE_UMQ, > + .dev_priv = &npu3_dev_priv, > + .fw_feature_tbl = npu3_fw_feature_table, > + .cert_feature_tbl = npu3_cert_feature_table, > + .ops = &aie4_classic_ops, > +}; [Severity: Medium] Since dev_mem_size is omitted here, it defaults to 0. Does this cause a kernel warning when creating a device heap BO? If an unprivileged user opens the accelerator device and requests a BO with type AMDXDNA_BO_DEV_HEAP, the ioctl dispatcher calls amdxdna_drm_create_dev_heap_bo() which unconditionally evaluates: WARN_ON(!is_power_of_2(xdna->dev_info->dev_mem_size)); Since dev_mem_size is 0, this will evaluate to true and trigger a warning, potentially causing a local denial of service if panic_on_warn is enabled. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=5
