Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Using devm_of_reserved_mem_device_init ties the reserved memory release to the physical device unbind, which executes before DRM GEM objects are freed. This leads to a kernel panic in dma_free_wc() during driver unload or when userspace closes the device. --
commit af4228b344b701076f4bd88aa57c810ff4e26c48 Author: Mukesh Ojha <[email protected]> drm: aspeed: Use devm_of_reserved_mem_device_init() This commit replaces of_reserved_mem_device_init() with the devres-managed devm_of_reserved_mem_device_init() to ensure the reserved memory region is released on device removal. > diff --git a/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c > b/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c > index d4577663a1f0e..2c7e54fc35d93 100644 > --- a/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c > +++ b/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c > @@ -168,7 +168,7 @@ static int aspeed_gfx_load(struct drm_device *drm) > } > } > > - ret = of_reserved_mem_device_init(drm->dev); > + ret = devm_of_reserved_mem_device_init(drm->dev); [Severity: High] Will tying the reserved memory release to the physical device unbind phase cause a kernel panic if a user holds an open DRM file descriptor? The devm_of_reserved_mem_device_init() cleanup runs when the platform device unbinds, calling of_reserved_mem_device_release() which clears dev->dma_mem. However, if userspace holds an open DRM file descriptor, the DRM device and its GEM objects outlive the platform device's devres cleanup phase. When the user eventually closes the file descriptor, the GEM objects are freed. At that point, drm_gem_dma_free() calls dma_free_wc(), which relies on dev->dma_mem to identify the reserved memory pool. Since dev->dma_mem was already cleared during the unbind devres cleanup, it falls back to the system page allocator, which results in a kernel panic. > if (ret) { > dev_err(&pdev->dev, > "failed to initialize reserved mem: %d\n", ret); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=10
