From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/sched: fix NULL deref when logging missing entity runqueue Date: Thu, 04 Jun 2026 11:58:59 +1000 Message-ID: In-Reply-To: <20260603025636.1301481-1-candice.li@amd.com> References: <20260603025636.1301481-1-candice.li@amd.com> <20260603025636.1301481-1-candice.li@amd.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Patch Review **Bug analysis =E2=80=94 correct:** The commit message accurately describes the problem. In `drm_sched_job_init= ()`, when `entity->rq` is NULL (line 591), the code immediately tries: ```c dev_err(job->sched->dev, "%s: entity has no rq!\n", __func__); ``` At this point `job->sched` has not been set =E2=80=94 `job->sched` is assig= ned only in `drm_sched_job_arm()` (line 653). Since the function hasn't eve= n reached the `memset(job, 0, sizeof(*job))` on line 611 yet, `job->sched` = is whatever was in the caller's memory, making this a NULL or wild-pointer = dereference. **Fix =E2=80=94 correct but has a style nit:** ```c pr_err("*ERROR* %s: entity has no rq!\n", __func__); ``` Switching from `dev_err()` to `pr_err()` is the right approach since there'= s no valid device pointer available at this point. **Nit:** The `*ERROR*` prefix is inconsistent with kernel logging conventio= ns. `pr_err()` already logs at error level and the kernel adds the appropri= ate severity marker. The existing `*ERROR*` prefix on the credits check at = line 601 is pre-existing code, but propagating the pattern isn't ideal. A s= imple `pr_err("%s: entity has no rq!\n", __func__)` or `pr_err("drm_sched: = entity has no rq!\n")` would be cleaner. That said, matching the existing p= attern on line 601 is defensible for consistency within this function. **Missing Fixes tag:** Given this is a real NULL-deref crash fix, the patch= should carry a `Fixes:` tag pointing to the commit that introduced the `de= v_err()` call with `job->sched->dev`. This helps stable-kernel backport pro= cesses. **Overall:** The fix is correct, minimal, and addresses a real crash. Recom= mend adding the `Fixes:` tag and optionally dropping the `*ERROR*` prefix. --- Generated by Claude Code Patch Reviewer