linux-kernel - [PATCH 0/2] accel/rocket: fix unwinding in error paths of two functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251215-rocket-error-path-v1-0-eec3bf29dc3b@cherry.de>
Date: Mon, 15 Dec 2025 17:36:13 +0100
From: Quentin Schulz <foss+kernel@...il.net>
To: Tomeu Vizoso <tomeu@...euvizoso.net>, Oded Gabbay <ogabbay@...nel.org>, 
 Jeff Hugo <jeff.hugo@....qualcomm.com>
Cc: dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org, 
 linux-rockchip@...ts.infradead.org, 
 Quentin Schulz <quentin.schulz@...rry.de>, stable@...r.kernel.org
Subject: [PATCH 0/2] accel/rocket: fix unwinding in error paths of two
 functions

As reported[1], in the current state of master (that is, *without*
that[2] patch, yet unmerged), it is possible to trigger
Oops/out-of-bounds errors/unbalanced runtime PM by simply compiling
DRM_ACCEL_ROCKET built-in (=y) instead of as a module (=m).

This fixes points 1 and 2 reported here[1] by fixing the unwinding in
two functions to properly undo everything done in the same function
prior to the error.

Note that this doesn't mean the Rocket device is usable if one core is
missing. In fact, it seems it doesn't as I'm hit with many
rocket fdac0000.npu: NPU job timed out
followed by one
rocket fdad0000.npu: NPU job timed out
(and that, five times) whenever core0 (fdab0000.npu) fails to probe and
I'm running the example from
https://docs.mesa3d.org/teflon.html#do-some-inference-with-mobilenetv1
so something else probably needs some additional love.

[1] https://lore.kernel.org/linux-rockchip/0b20d760-ad4f-41c0-b733-39db10d6cc41@cherry.de/
[2] https://lore.kernel.org/linux-rockchip/20251205064739.20270-1-rmxpzlb@gmail.com/

Signed-off-by: Quentin Schulz <quentin.schulz@...rry.de>
---
Quentin Schulz (2):
      accel/rocket: fix unwinding in error path in rocket_core_init
      accel/rocket: fix unwinding in error path in rocket_probe

 drivers/accel/rocket/rocket_core.c |  7 +++++--
 drivers/accel/rocket/rocket_drv.c  | 15 ++++++++++++++-
 2 files changed, 19 insertions(+), 3 deletions(-)
---
base-commit: a619746d25c8adafe294777cc98c47a09759b3ed
change-id: 20251212-rocket-error-path-f9784c46a503

Best regards,
-- 
Quentin Schulz <quentin.schulz@...rry.de>