1. Patchew
  2. linux
  3. View series

[PATCH v2] media: verisilicon: Fix kernel panic due to __initconst misuse

ming.qian@oss.nxp.com posted 1 patch 1 month ago
There is a newer version of this series
drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
[PATCH v2] media: verisilicon: Fix kernel panic due to __initconst misuse
Posted by ming.qian@oss.nxp.com 1 month ago 
From: Ming Qian <ming.qian@oss.nxp.com>

Fix a kernel panic when probing the driver as a module:

  Unable to handle kernel paging request at virtual address
  ffffd9c18eb05000
  of_find_matching_node_and_match+0x5c/0x1a0
  hantro_probe+0x2f4/0x7d0 [hantro_vpu]

The imx8mq_vpu_shared_resources array is referenced by variant
structures through their shared_devices field. When built as a
module, __initconst causes this data to be freed after module
init, but it's later accessed during probe, causing a page fault.

The imx8mq_vpu_shared_resources is referenced from non-init code,
so keeping __initconst or __initconst_or_module here is wrong.

Drop the __initconst annotation and let it live in the normal .rodata
section.

Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
---
v2
- Remove __initconst
- Add missing Reported-by tag
- Add missing Suggested-by tag
- Remove comments of sentinel to pass checkpatch.pl

 drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
index 6f8e43b7f157..6fbe3c581032 100644
--- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
@@ -343,10 +343,10 @@ const struct hantro_variant imx8mq_vpu_variant = {
 	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
 };
 
-static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
+static const struct of_device_id imx8mq_vpu_shared_resources[] = {
 	{ .compatible = "nxp,imx8mq-vpu-g1", },
 	{ .compatible = "nxp,imx8mq-vpu-g2", },
-	{ /* sentinel */ }
+	{}
 };
 
 const struct hantro_variant imx8mq_vpu_g1_variant = {
-- 
2.52.0
Re: [PATCH v2] media: verisilicon: Fix kernel panic due to __initconst misuse
Posted by Marco Felsch 1 month ago 
On 26-03-05, ming.qian@oss.nxp.com wrote:
> From: Ming Qian <ming.qian@oss.nxp.com>
> 
> Fix a kernel panic when probing the driver as a module:
> 
>   Unable to handle kernel paging request at virtual address
>   ffffd9c18eb05000
>   of_find_matching_node_and_match+0x5c/0x1a0
>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
> 
> The imx8mq_vpu_shared_resources array is referenced by variant
> structures through their shared_devices field. When built as a
> module, __initconst causes this data to be freed after module
> init, but it's later accessed during probe, causing a page fault.
> 
> The imx8mq_vpu_shared_resources is referenced from non-init code,
> so keeping __initconst or __initconst_or_module here is wrong.
> 
> Drop the __initconst annotation and let it live in the normal .rodata
> section.
> 
> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
> Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
> Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
> Suggested-by: Marco Felsch <m.felsch@pengutronix.de>

This fix was suggested by Krzysztof :)

> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
> ---
> v2
> - Remove __initconst
> - Add missing Reported-by tag
> - Add missing Suggested-by tag
> - Remove comments of sentinel to pass checkpatch.pl
> 
>  drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> index 6f8e43b7f157..6fbe3c581032 100644
> --- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> +++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
> @@ -343,10 +343,10 @@ const struct hantro_variant imx8mq_vpu_variant = {
>  	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
>  };
>  
> -static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
> +static const struct of_device_id imx8mq_vpu_shared_resources[] = {
>  	{ .compatible = "nxp,imx8mq-vpu-g1", },
>  	{ .compatible = "nxp,imx8mq-vpu-g2", },
> -	{ /* sentinel */ }
> +	{}

Unnecessary change.

With both fixed:

Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>


>  };
>  
>  const struct hantro_variant imx8mq_vpu_g1_variant = {
> -- 
> 2.52.0
> 
> 

-- 
#gernperDu 
#CallMeByMyFirstName

Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |
Re: [PATCH v2] media: verisilicon: Fix kernel panic due to __initconst misuse
Posted by Ming Qian(OSS) 1 month ago 
Hi Marco，

On 3/5/2026 6:32 PM, Marco Felsch wrote:
> On 26-03-05, ming.qian@oss.nxp.com wrote:
>> From: Ming Qian <ming.qian@oss.nxp.com>
>>
>> Fix a kernel panic when probing the driver as a module:
>>
>>    Unable to handle kernel paging request at virtual address
>>    ffffd9c18eb05000
>>    of_find_matching_node_and_match+0x5c/0x1a0
>>    hantro_probe+0x2f4/0x7d0 [hantro_vpu]
>>
>> The imx8mq_vpu_shared_resources array is referenced by variant
>> structures through their shared_devices field. When built as a
>> module, __initconst causes this data to be freed after module
>> init, but it's later accessed during probe, causing a page fault.
>>
>> The imx8mq_vpu_shared_resources is referenced from non-init code,
>> so keeping __initconst or __initconst_or_module here is wrong.
>>
>> Drop the __initconst annotation and let it live in the normal .rodata
>> section.
>>
>> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
>> Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
>> Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
>> Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
> 
> This fix was suggested by Krzysztof :)
> 

I will add it in next version.

>> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
>> ---
>> v2
>> - Remove __initconst
>> - Add missing Reported-by tag
>> - Add missing Suggested-by tag
>> - Remove comments of sentinel to pass checkpatch.pl
>>
>>   drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
>> index 6f8e43b7f157..6fbe3c581032 100644
>> --- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
>> +++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
>> @@ -343,10 +343,10 @@ const struct hantro_variant imx8mq_vpu_variant = {
>>   	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
>>   };
>>   
>> -static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
>> +static const struct of_device_id imx8mq_vpu_shared_resources[] = {
>>   	{ .compatible = "nxp,imx8mq-vpu-g1", },
>>   	{ .compatible = "nxp,imx8mq-vpu-g2", },
>> -	{ /* sentinel */ }
>> +	{}
> 
> Unnecessary change.
> 

Yes, I know, but I get the following error reported by checkpatch.pl

	ERROR: missing sentinel in ID array
	#50: FILE: drivers/media/platform/verisilicon/imx8m_vpu_hw.c:346:
	+static const struct of_device_id imx8mq_vpu_shared_resources[] = {
	        { .compatible = "XXXXXXXXXXXXXXXXX", },
	        { .compatible = "XXXXXXXXXXXXXXXXX", },
	        {  }


	total: 1 errors, 0 warnings, 0 checks, 8 lines checked

so I made this change to pass checkpatch.pl

Regards,
Ming

> With both fixed:
> 
> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
> 
> 
>>   };
>>   
>>   const struct hantro_variant imx8mq_vpu_g1_variant = {
>> -- 
>> 2.52.0
>>
>>
>
Re: [PATCH v2] media: verisilicon: Fix kernel panic due to __initconst misuse
Posted by Krzysztof Kozlowski 1 month ago 
On 05/03/2026 11:32, Marco Felsch wrote:
> On 26-03-05, ming.qian@oss.nxp.com wrote:
>> From: Ming Qian <ming.qian@oss.nxp.com>
>>
>> Fix a kernel panic when probing the driver as a module:
>>
>>   Unable to handle kernel paging request at virtual address
>>   ffffd9c18eb05000
>>   of_find_matching_node_and_match+0x5c/0x1a0
>>   hantro_probe+0x2f4/0x7d0 [hantro_vpu]
>>
>> The imx8mq_vpu_shared_resources array is referenced by variant
>> structures through their shared_devices field. When built as a
>> module, __initconst causes this data to be freed after module
>> init, but it's later accessed during probe, causing a page fault.
>>
>> The imx8mq_vpu_shared_resources is referenced from non-init code,
>> so keeping __initconst or __initconst_or_module here is wrong.
>>
>> Drop the __initconst annotation and let it live in the normal .rodata
>> section.
>>
>> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
>> Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
>> Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
>> Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
> 
> This fix was suggested by Krzysztof :)

Or at least a bug of __initconst called from regular non-init probe code
leading to bugs during probe deferrals or during unbind-bind cycles...

Closes:
https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>

?

Best regards,
Krzysztof
Re: [PATCH v2] media: verisilicon: Fix kernel panic due to __initconst misuse
Posted by Ming Qian(OSS) 1 month ago 
Hi

On 3/5/2026 8:04 PM, Krzysztof Kozlowski wrote:
> On 05/03/2026 11:32, Marco Felsch wrote:
>> On 26-03-05, ming.qian@oss.nxp.com wrote:
>>> From: Ming Qian <ming.qian@oss.nxp.com>
>>>
>>> Fix a kernel panic when probing the driver as a module:
>>>
>>>    Unable to handle kernel paging request at virtual address
>>>    ffffd9c18eb05000
>>>    of_find_matching_node_and_match+0x5c/0x1a0
>>>    hantro_probe+0x2f4/0x7d0 [hantro_vpu]
>>>
>>> The imx8mq_vpu_shared_resources array is referenced by variant
>>> structures through their shared_devices field. When built as a
>>> module, __initconst causes this data to be freed after module
>>> init, but it's later accessed during probe, causing a page fault.
>>>
>>> The imx8mq_vpu_shared_resources is referenced from non-init code,
>>> so keeping __initconst or __initconst_or_module here is wrong.
>>>
>>> Drop the __initconst annotation and let it live in the normal .rodata
>>> section.
>>>
>>> Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
>>> Reported-by: Franz Schnyder <franz.schnyder@toradex.com>
>>> Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/
>>> Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
>>
>> This fix was suggested by Krzysztof :)
> 
> Or at least a bug of __initconst called from regular non-init probe code
> leading to bugs during probe deferrals or during unbind-bind cycles...
> 
> Closes:
> https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/
> Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> 
> ?
> 

Thanks for your help, I will add this in next version.

> Best regards,
> Krzysztof

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.