Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues: - [High] Incomplete Fix / Uninitialized Return Value leaking positive jiffies to VFS - [High] Resource leak due to missing `drm_crtc_vblank_put()` on error paths -- commit 4554672736d3ae3e68d6ba478384d8757a136c1f Author: Tom Chung <[email protected]> Date: Mon Aug 31 13:24:53 2026 +0000 drm/amd/display: Fix CRC open failure during active rendering This commit changes the wait_for_completion_interruptible_timeout() handling to treat a positive return value (remaining jiffies) as success, 0 as timeout, and negative as an error. > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c > b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c > index e20aa74380665..596a97092e0dd 100644 > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c > @@ -584,8 +584,13 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, > const char *src_name) > */ > ret = wait_for_completion_interruptible_timeout( > &commit->hw_done, 10 * HZ); > - if (ret) > + if (ret < 0) > + goto cleanup; > + > + if (ret == 0) { > + ret = -ETIMEDOUT; > goto cleanup; > + } > } > > enable = amdgpu_dm_is_valid_crc_source(source); [Severity: High] This isn't a bug introduced by this patch, but wait_for_completion_interruptible_timeout() returns the positive remaining jiffies on success. Since ret is not explicitly reset to 0 here, it can retain this positive value. If the condition !enabled && enable evaluates to false later in the function, ret is never overwritten to 0 by drm_crtc_vblank_get(). This leaves the function returning the unmodified positive ret value to the VFS caller. Returning a positive value from a VFS open() operation triggers a WARN_ON_ONCE(error > 0) in do_dentry_open(), which causes a kernel panic if panic_on_warn is enabled. Should ret be explicitly reset to 0 upon success to prevent leaking positive jiffies to the VFS layer? [ ... ] > /* > * Reading the CRC requires the vblank interrupt handler to be > * enabled. Keep a reference until CRC capture stops. > */ > enabled = amdgpu_dm_is_valid_crc_source(cur_crc_src); > if (!enabled && enable) { > ret = drm_crtc_vblank_get(crtc); > if (ret) > goto cleanup; > } > > #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) > /* Reset secure_display when we change crc source from debugfs */ > amdgpu_dm_set_crc_window_default(crtc, crtc_state->stream); > #endif > > if (amdgpu_dm_crtc_configure_crc_source(crtc, crtc_state, source)) { > ret = -EINVAL; > goto cleanup; > } > > if (!enabled && enable) { > if (dm_is_crc_source_dprx(source)) { > if (drm_dp_start_crc(aux, crtc)) { > DRM_DEBUG_DRIVER("dp start crc failed\n"); > ret = -EINVAL; > goto cleanup; > } > } [Severity: High] This is a pre-existing issue, but does this error path leak the vblank reference? If amdgpu_dm_crtc_configure_crc_source() or drm_dp_start_crc() fail, the code jumps to the cleanup label without calling drm_crtc_vblank_put() to balance the reference successfully acquired earlier via drm_crtc_vblank_get(). This can permanently leak a CRTC vblank reference count, preventing the display subsystem from entering low-power states. Should drm_crtc_vblank_put() be called on these error paths before jumping to cleanup? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
