From nobody Sat Jul 25 16:21:06 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D07B3DEFFC; Thu, 16 Jul 2026 08:26:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784190367; cv=none; b=DGTevrnaOsNOuYOCNNtSvFMcbOrl70ztobCLgmYkXDmXBQQZTL2PvQOZQKCIDkoMj6+Zb0kMVuRHe+m1fphMFqJc9iOq6HtnEHcgVcoBQnrnbBuzm0Tv4ULencG6VzK4HPXAaTFC9wRoeR8yzIQMEYzLDIQ7xqbrJw6QXEnjD1k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784190367; c=relaxed/simple; bh=E9HT42qopx9eAGCOiXYL83ZD2PANskp8DP/mmBWF//U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=m0d2NqwyAvo0DQaLtSFjH32QcidnmPb+o03V+kFNRJYt5VJw6y/oZurzmJnyt04OIFSXbFFS3svOen1lUEtsarCpWi4R3ao5CfHepVauwWgOgSnDydsYulmaKfif7NQ8i/yMaG7BERIMNuB6I139NTA45oCn55Z37HlIq3c2zF0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: f67a4e1480ef11f1aa26b74ffac11d73-20260716 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:4720123a-3270-455f-a2f5-a911758aafe1,IP:15, URL:25,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:35 X-CID-INFO: VERSION:1.3.12,REQID:4720123a-3270-455f-a2f5-a911758aafe1,IP:15,UR L:25,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:35 X-CID-META: VersionHash:e7bac3a,CLOUDID:11420e8b4e8d9b46fd85191da5cc35db,BulkI D:260716162555F716U1XW,BulkQuantity:0,Recheck:0,SF:10|38|57|66|78|80|81|82 |102|123|127|136|841|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:11|93 |82|1,File:nil,RT:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1 ,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR,TF_CID_SPAM_ULN X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f67a4e1480ef11f1aa26b74ffac11d73-20260716 X-User: zhaoguohan@kylinos.cn Received: from zgh-vmware-virtual-platform.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 943019971; Thu, 16 Jul 2026 16:25:54 +0800 From: zhaoguohan@kylinos.cn To: "Rob Herring (Arm)" , Tomeu Vizoso , dri-devel@lists.freedesktop.org Cc: Oded Gabbay , Frank Li , Thomas Zimmermann , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 1/3] accel/ethosu: clean up resources on probe failure Date: Thu, 16 Jul 2026 16:25:28 +0800 Message-ID: <20260716082530.1023538-2-zhaoguohan@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260716082530.1023538-1-zhaoguohan@kylinos.cn> References: <20260716082530.1023538-1-zhaoguohan@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: GuoHan Zhao ethosu_job_init() creates a scheduler before ethosu_init() and drm_dev_register(). Errors from either later step return directly, leaving the scheduler workqueue allocated. A drm_dev_register() failure also leaves the optional SRAM allocation behind. Unwind runtime PM, SRAM, and scheduler state in reverse order on probe failure. Disable the clocks when runtime PM setup fails as well. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Reported-by: Sashiko Link: https://sashiko.dev/#/patchset/20260716065219.931088-1-zhaoguohan@kyl= inos.cn?part=3D1 Signed-off-by: GuoHan Zhao --- Sashiko report: > This is a pre-existing issue, but was not introduced by this patch. > > If ethosu_init() or drm_dev_register() fail, the function returns > directly without calling ethosu_job_fini() or freeing the sram pool. > > Because the job scheduler is embedded in the devm-allocated > ethosu_device, it will be freed when devm cleans up. However, the drm > scheduler kthreads and timers remain active and will access the freed > memory. > > Can this cause a use-after-free regression leading to a kernel panic? drivers/accel/ethosu/ethosu_drv.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index ed9c748a54ad..d1153b15ca3e 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -293,6 +293,14 @@ static int ethosu_sram_init(struct ethosu_device *etho= sudev) return 0; } =20 +static void ethosu_sram_fini(struct ethosu_device *ethosudev) +{ + if (ethosudev->sram) + gen_pool_free(ethosudev->srampool, + (unsigned long)ethosudev->sram, + ethosudev->npu_info.sram_size); +} + static int ethosu_init(struct ethosu_device *ethosudev) { int ret; @@ -306,7 +314,7 @@ static int ethosu_init(struct ethosu_device *ethosudev) pm_runtime_use_autosuspend(ethosudev->base.dev); ret =3D devm_pm_runtime_set_active_enabled(ethosudev->base.dev); if (ret) - return ret; + goto err_suspend; pm_runtime_get_noresume(ethosudev->base.dev); =20 ethosudev->npu_info.id =3D id =3D readl_relaxed(ethosudev->regs + NPU_REG= _ID); @@ -326,6 +334,11 @@ static int ethosu_init(struct ethosu_device *ethosudev) ethosudev->npu_info.sram_size / 1024); =20 return 0; + +err_suspend: + pm_runtime_dont_use_autosuspend(ethosudev->base.dev); + ethosu_device_suspend(ethosudev->base.dev); + return ret; } =20 static int ethosu_probe(struct platform_device *pdev) @@ -353,13 +366,21 @@ static int ethosu_probe(struct platform_device *pdev) =20 ret =3D ethosu_init(ethosudev); if (ret) - return ret; + goto err_job_fini; =20 ret =3D drm_dev_register(ðosudev->base, 0); if (ret) - pm_runtime_dont_use_autosuspend(ethosudev->base.dev); + goto err_runtime_suspend; =20 pm_runtime_put_autosuspend(ethosudev->base.dev); + return 0; + +err_runtime_suspend: + pm_runtime_dont_use_autosuspend(ethosudev->base.dev); + pm_runtime_put_sync_suspend(ethosudev->base.dev); + ethosu_sram_fini(ethosudev); +err_job_fini: + ethosu_job_fini(ethosudev); return ret; } =20 @@ -369,9 +390,7 @@ static void ethosu_remove(struct platform_device *pdev) =20 drm_dev_unregister(ðosudev->base); ethosu_job_fini(ethosudev); - if (ethosudev->sram) - gen_pool_free(ethosudev->srampool, (unsigned long)ethosudev->sram, - ethosudev->npu_info.sram_size); + ethosu_sram_fini(ethosudev); } =20 static const struct of_device_id dt_match[] =3D { --=20 2.43.0 From nobody Sat Jul 25 16:21:06 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E17223DD51F; Thu, 16 Jul 2026 08:26:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784190367; cv=none; b=L7kzk60cksZDLZYF2f1TV45c3MchRusV4x5Yki4xMz/XMvAYdeHK80s01boSqx2a2oPxpz7WMwFPlwd7la1B2H6Zbwyl11Anu96mjb45KMH3ueOFYEZMcPKXS40j2/HRiJEUqERD85h3ZaIrmze90lrXsTYSXlkpK/FvEnYJDjs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784190367; c=relaxed/simple; bh=BFKDMvrAO5Dq5lrJOKq1Y0usWKQnmmHR+ihRNn1ZnOw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZZ4LbJ4Z4qmwvlztXe2GuFvPELUpv/rpc/GxFNqfZ8PoVHyxr7PpXyxrslknf9jpimXmwRukdpRpMYzrGzp7E5KnyAT1SyIUAjgDXG9lvXuePxMZmsc2lAEjyNa0BtrO/AX0L8F5wdqANFHMaiyEDzVnype5KCWMB5vN2fvZW80= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: f6e83ed880ef11f1aa26b74ffac11d73-20260716 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:564aa6ea-7126-41ce-a8ab-43411b078d6a,IP:15, URL:25,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:35 X-CID-INFO: VERSION:1.3.12,REQID:564aa6ea-7126-41ce-a8ab-43411b078d6a,IP:15,UR L:25,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:35 X-CID-META: VersionHash:e7bac3a,CLOUDID:0d25f18fabaf7a7729211895d275d9c7,BulkI D:260716162555421W5OS2,BulkQuantity:0,Recheck:0,SF:10|38|57|66|78|80|81|82 |102|123|127|136|841|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:93|82 |11|1,File:nil,RT:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1 ,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_ULN,TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f6e83ed880ef11f1aa26b74ffac11d73-20260716 X-User: zhaoguohan@kylinos.cn Received: from zgh-vmware-virtual-platform.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1907087791; Thu, 16 Jul 2026 16:25:55 +0800 From: zhaoguohan@kylinos.cn To: "Rob Herring (Arm)" , Tomeu Vizoso , dri-devel@lists.freedesktop.org Cc: Oded Gabbay , Frank Li , Thomas Zimmermann , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 2/3] accel/ethosu: propagate SRAM initialization errors Date: Thu, 16 Jul 2026 16:25:29 +0800 Message-ID: <20260716082530.1023538-3-zhaoguohan@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260716082530.1023538-1-zhaoguohan@kylinos.cn> References: <20260716082530.1023538-1-zhaoguohan@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: GuoHan Zhao ethosu_sram_init() returns -ENOMEM if allocation from a declared SRAM pool fails. ethosu_init() ignores the error after recording the pool size. Probe then registers a device with a nonzero SRAM size and a zero sramphys address, allowing jobs to program address zero for SRAM. Propagate the error and synchronously suspend the device before the probe path releases the scheduler. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Reported-by: Sashiko Link: https://sashiko.dev/#/patchset/20260716065219.931088-1-zhaoguohan@kyl= inos.cn?part=3D1 Signed-off-by: GuoHan Zhao --- Sashiko report: > This is a pre-existing issue, but was not introduced by this patch. > > In ethosu_sram_init(), if gen_pool_dma_alloc() fails, it returns an > error. However, ethosu_init() ignores this return value. > > Because npu_info.sram_size was already set to gen_pool_size(), it remains > non-zero while sramphys remains 0. > > When a user submits a job requesting sram, the size check passes, and > ethosu_job_hw_submit() configures the hardware to use physical sram > address 0x0. > > Could this result in a memory corruption regression or an IOMMU fault? drivers/accel/ethosu/ethosu_drv.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index d1153b15ca3e..479156f79bc1 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -320,7 +320,9 @@ static int ethosu_init(struct ethosu_device *ethosudev) ethosudev->npu_info.id =3D id =3D readl_relaxed(ethosudev->regs + NPU_REG= _ID); ethosudev->npu_info.config =3D config =3D readl_relaxed(ethosudev->regs += NPU_REG_CONFIG); =20 - ethosu_sram_init(ethosudev); + ret =3D ethosu_sram_init(ethosudev); + if (ret) + goto err_runtime_suspend; =20 dev_info(ethosudev->base.dev, "Ethos-U NPU, arch v%ld.%ld.%ld, rev r%ldp%ld, cmd stream ver%ld, %d MA= Cs, %dKB SRAM\n", @@ -335,6 +337,10 @@ static int ethosu_init(struct ethosu_device *ethosudev) =20 return 0; =20 +err_runtime_suspend: + pm_runtime_dont_use_autosuspend(ethosudev->base.dev); + pm_runtime_put_sync_suspend(ethosudev->base.dev); + return ret; err_suspend: pm_runtime_dont_use_autosuspend(ethosudev->base.dev); ethosu_device_suspend(ethosudev->base.dev); --=20 2.43.0 From nobody Sat Jul 25 16:21:06 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC0523D3CEC; Thu, 16 Jul 2026 08:26:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784190368; cv=none; b=dWOgzkpvuJwEltHX8T+bJMCaeR++RrDS0Ycf7ItYifX5Cu6oDnj7nJig0iiKFlcCnF/8PUalsx8nocseawqRqRKdoD38ILfLeagc43DkvcfPKakYo+OFu8ii/60l8CNXTVyjckZ5VX2NhXLkgdpAOj0kb/q9NuszG+UdMcl58sg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784190368; c=relaxed/simple; bh=nz62sHLjQi5CpoPoDG4kmScDPG6IyitcREyHqaX4rMY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dcyt/2d8TnBQMN/1v/IPIuPVTHQrl/5keQujAJ1ay+4q1Eixd3uKhracO+O2AJYKumeOiBP8g7fWkM/rjm5z1AlC17MKbaZmO0RcIZoVQwBXa+EEeN+7bGRn84RZlqLcaIilb8xTfwd5upLyH2dYGtMS+ym+sDdNNpKkta9UkNA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: f73253ec80ef11f1aa26b74ffac11d73-20260716 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:b14128e5-a760-4486-9e89-827271766f0e,IP:15, URL:25,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:35 X-CID-INFO: VERSION:1.3.12,REQID:b14128e5-a760-4486-9e89-827271766f0e,IP:15,UR L:25,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:35 X-CID-META: VersionHash:e7bac3a,CLOUDID:a4d5be2708a8940dd70dc61d4d17da1b,BulkI D:260716162558JML0MJ9C,BulkQuantity:0,Recheck:0,SF:10|38|57|66|78|80|81|82 |102|123|127|136|841|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:11|93 |82|1,File:nil,RT:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1 ,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR,TF_CID_SPAM_ULN X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: f73253ec80ef11f1aa26b74ffac11d73-20260716 X-User: zhaoguohan@kylinos.cn Received: from zgh-vmware-virtual-platform.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 894374176; Thu, 16 Jul 2026 16:25:55 +0800 From: zhaoguohan@kylinos.cn To: "Rob Herring (Arm)" , Tomeu Vizoso , dri-devel@lists.freedesktop.org Cc: Oded Gabbay , Frank Li , Thomas Zimmermann , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 3/3] accel/ethosu: fix job completion fence cleanup Date: Thu, 16 Jul 2026 16:25:30 +0800 Message-ID: <20260716082530.1023538-4-zhaoguohan@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260716082530.1023538-1-zhaoguohan@kylinos.cn> References: <20260716082530.1023538-1-zhaoguohan@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: GuoHan Zhao ethosu_ioctl_submit_job() allocates done_fence before validating buffer handles. Errors after allocation call ethosu_job_err_cleanup(), which frees the job but leaks the uninitialized fence. A scheduler dependency error also lets ethosu_job_run() return before dma_fence_init(). Normal cleanup then passes a zeroed refcount to dma_fence_put(). Release done_fence in the common cleanup path and use dma_fence_was_initialized() to distinguish initialized fences from raw allocations. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Reported-by: Sashiko Link: https://sashiko.dev/#/patchset/20260716065219.931088-1-zhaoguohan@kyl= inos.cn?part=3D1 Signed-off-by: GuoHan Zhao --- Sashiko reports: > drivers/accel/ethosu/ethosu_job.c:ethosu_job_err_cleanup() { > unsigned int i; > > for (i =3D 0; i < job->region_cnt; i++) > drm_gem_object_put(job->region_bo[i]); > > drm_gem_object_put(job->cmd_bo); > > kfree(job); > } > > This is a pre-existing issue, but was not introduced by this patch. > > ethosu_ioctl_submit_job() allocates done_fence. If a subsequent > validation fails, the error path calls ethosu_job_err_cleanup(). > > This function frees the job structure but misses freeing job->done_fence. > > Can an unprivileged user repeatedly call the submit ioctl with invalid > handles to trigger a done_fence leak? > drivers/accel/ethosu/ethosu_job.c:ethosu_job_run() { > ... > if (unlikely(job->base.s_fence->finished.error)) > return NULL; > > dma_fence_init(fence, ðosu_fence_ops, &dev->fence_lock, > dev->fence_context, ++dev->emit_seqno); > ... > } > > This is a pre-existing issue, but was not introduced by this patch. > > If job->base.s_fence->finished.error is true, the function returns early > without calling dma_fence_init() on job->done_fence. > > When the job is later destroyed, ethosu_job_cleanup() unconditionally > calls dma_fence_put() on the fence: > > drivers/accel/ethosu/ethosu_job.c:ethosu_job_cleanup() { > ... > dma_fence_put(job->done_fence); > ... > } > > Since the fence is zero-initialized, will calling kref_put() on it > violate the API and cause a refcount underflow? drivers/accel/ethosu/ethosu_job.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethos= u_job.c index b76924645aaa..be745e36f1fa 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -152,6 +152,13 @@ static void ethosu_job_err_cleanup(struct ethosu_job *= job) =20 drm_gem_object_put(job->cmd_bo); =20 + if (job->done_fence) { + if (dma_fence_was_initialized(job->done_fence)) + dma_fence_put(job->done_fence); + else + dma_fence_free(job->done_fence); + } + kfree(job); } =20 @@ -162,7 +169,6 @@ static void ethosu_job_cleanup(struct kref *ref) =20 pm_runtime_put_autosuspend(job->dev->base.dev); =20 - dma_fence_put(job->done_fence); dma_fence_put(job->inference_done_fence); =20 ethosu_job_err_cleanup(job); --=20 2.43.0