From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: accel/ethosu: reject NPU_OP_RESIZE commands from userspace Date: Mon, 25 May 2026 17:19:40 +1000 Message-ID: In-Reply-To: <20260523210840.92039-2-meatuni001@gmail.com> References: <20260523210840.92039-1-meatuni001@gmail.com> <20260523210840.92039-2-meatuni001@gmail.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Patch Review **Verdict: Correct fix, one minor style observation.** The change replaces: ```c case NPU_OP_RESIZE: // U85 only WARN_ON(1); // TODO break; ``` with: ```c case NPU_OP_RESIZE: // U85 only return -EINVAL; ``` This is the right approach. The `WARN_ON(1)` was unconditionally user-trigg= erable from unprivileged userspace via `DRM_IOCTL_ETHOSU_GEM_CREATE`, makin= g it a DoS vector (kernel log spam, or panic if `panic_on_warn` is set). Re= turning `-EINVAL` properly rejects the command at the ioctl level. **Minor observation:** The `default:` case at line 650 silently ignores unk= nown opcodes (`break` with no error). This means `NPU_OP_RESIZE` is now tre= ated *more strictly* than completely unknown/garbage opcodes =E2=80=94 it r= eturns an error, while unknown commands are silently accepted and passed th= rough. This is arguably the right behavior for a known-but-unimplemented op= code, but the maintainer may want to consider whether `default:` should als= o return `-EINVAL` in a follow-up, since silently ignoring unrecognized com= mands seems fragile for a security-sensitive parser. **No issues with fall-through:** The `return -EINVAL` exits the function en= tirely, so the absence of `break` before `case NPU_SET_KERNEL_WIDTH_M1:` is= correct =E2=80=94 there's no fall-through path. --- Generated by Claude Code Patch Reviewer