From a6709a58a01c8fc357e316bee31f369c2ea56235 Mon Sep 17 00:00:00 2001 From: Sidong Yang Date: Mon, 5 Oct 2026 01:47:25 +0900 Subject: [PATCH] accel/rocket: Don't tear down the scheduler when drm_sched_init() fails drm_sched_init() cleans up after itself when it fails, but rocket_job_init() then calls drm_sched_fini() on the same scheduler. That wakes a wait queue that was never initialised, dereferencing a NULL pointer, and can destroy the submit workqueue a second time. Only destroy the reset workqueue on this path. Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260912114524.7A6131F00893@smtp.kernel.org/ Signed-off-by: Sidong Yang Reviewed-by: Jeff Hugo Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20261004164727.466164-2-sidong.yang@furiosa.ai --- drivers/accel/rocket/rocket_job.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c index f40435505818..319365ad7976 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -494,8 +494,6 @@ int rocket_job_init(struct rocket_core *core) return 0; err_sched: - drm_sched_fini(&core->sched); - destroy_workqueue(core->reset.wq); return ret; }