All of lore.kernel.org
 help / color / mirror / Atom feed
From: Chaoyi Chen <kernel@airkyi.com>
To: Tomeu Vizoso <tomeu@tomeuvizoso.net>,
	Oded Gabbay <ogabbay@kernel.org>,
	Heiko Stuebner <heiko@sntech.de>,
	Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Cc: linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
	linux-rockchip@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org,
	Chaoyi Chen <chaoyi.chen@rock-chips.com>
Subject: [PATCH 2/4] accel/rocket: Fix the panic in rocket_iommu_domain_put when the domain is NULL
Date: Fri, 14 Aug 2026 10:24:51 +0800	[thread overview]
Message-ID: <20260814022453.437-3-kernel@airkyi.com> (raw)
In-Reply-To: <20260814022453.437-1-kernel@airkyi.com>

From: Chaoyi Chen <chaoyi.chen@rock-chips.com>

In rocket_ioctl_submit_job(), since the domain is assigned last, an
error before that triggers rocket_job_put() -> rocket_job_cleanup()
-> rocket_iommu_domain_put() with the domain still NULL,
causing a panic in that function.

Therefore, the input parameters should be validated.

Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation")
Signed-off-by: Chaoyi Chen <chaoyi.chen@rock-chips.com>
---
 drivers/accel/rocket/rocket_drv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/rocket/rocket_drv.c b/drivers/accel/rocket/rocket_drv.c
index 8bbbce594883..77cd2ecce001 100644
--- a/drivers/accel/rocket/rocket_drv.c
+++ b/drivers/accel/rocket/rocket_drv.c
@@ -65,7 +65,8 @@ rocket_iommu_domain_get(struct rocket_file_priv *rocket_priv)
 void
 rocket_iommu_domain_put(struct rocket_iommu_domain *domain)
 {
-	kref_put(&domain->kref, rocket_iommu_domain_destroy);
+	if (domain)
+		kref_put(&domain->kref, rocket_iommu_domain_destroy);
 }
 
 static int
-- 
2.53.0


_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip

WARNING: multiple messages have this Message-ID (diff)
From: Chaoyi Chen <kernel@airkyi.com>
To: Tomeu Vizoso <tomeu@tomeuvizoso.net>,
	Oded Gabbay <ogabbay@kernel.org>,
	Heiko Stuebner <heiko@sntech.de>,
	Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Cc: linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
	linux-rockchip@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org,
	Chaoyi Chen <chaoyi.chen@rock-chips.com>
Subject: [PATCH 2/4] accel/rocket: Fix the panic in rocket_iommu_domain_put when the domain is NULL
Date: Fri, 14 Aug 2026 10:24:51 +0800	[thread overview]
Message-ID: <20260814022453.437-3-kernel@airkyi.com> (raw)
In-Reply-To: <20260814022453.437-1-kernel@airkyi.com>

From: Chaoyi Chen <chaoyi.chen@rock-chips.com>

In rocket_ioctl_submit_job(), since the domain is assigned last, an
error before that triggers rocket_job_put() -> rocket_job_cleanup()
-> rocket_iommu_domain_put() with the domain still NULL,
causing a panic in that function.

Therefore, the input parameters should be validated.

Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation")
Signed-off-by: Chaoyi Chen <chaoyi.chen@rock-chips.com>
---
 drivers/accel/rocket/rocket_drv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/rocket/rocket_drv.c b/drivers/accel/rocket/rocket_drv.c
index 8bbbce594883..77cd2ecce001 100644
--- a/drivers/accel/rocket/rocket_drv.c
+++ b/drivers/accel/rocket/rocket_drv.c
@@ -65,7 +65,8 @@ rocket_iommu_domain_get(struct rocket_file_priv *rocket_priv)
 void
 rocket_iommu_domain_put(struct rocket_iommu_domain *domain)
 {
-	kref_put(&domain->kref, rocket_iommu_domain_destroy);
+	if (domain)
+		kref_put(&domain->kref, rocket_iommu_domain_destroy);
 }
 
 static int
-- 
2.53.0



  parent reply	other threads:[~2026-08-14  2:26 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-14  2:24 [PATCH 0/4] accel/rocket: resource leak and stability improvements Chaoyi Chen
2026-08-14  2:24 ` Chaoyi Chen
2026-08-14  2:24 ` [PATCH 1/4] accel/rocket: Fix the IOMMU domain leak in rocket_ioctl_create_bo Chaoyi Chen
2026-08-14  2:24   ` Chaoyi Chen
2026-08-14  2:57   ` sashiko-bot
2026-08-14  2:24 ` Chaoyi Chen [this message]
2026-08-14  2:24   ` [PATCH 2/4] accel/rocket: Fix the panic in rocket_iommu_domain_put when the domain is NULL Chaoyi Chen
2026-08-14  3:22   ` sashiko-bot
2026-08-14  2:24 ` [PATCH 3/4] accel/rocket: Fix the extra iommu_group_get call in rocket_job_handle_irq Chaoyi Chen
2026-08-14  2:24   ` Chaoyi Chen
2026-08-14  3:33   ` sashiko-bot
2026-08-14  2:24 ` [PATCH 4/4] MAINTAINERS: accel/rocket: Add rockchip mail list for rocket Chaoyi Chen
2026-08-14  2:24   ` Chaoyi Chen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260814022453.437-3-kernel@airkyi.com \
    --to=kernel@airkyi.com \
    --cc=chaoyi.chen@rock-chips.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=heiko@sntech.de \
    --cc=jeff.hugo@oss.qualcomm.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-rockchip@lists.infradead.org \
    --cc=ogabbay@kernel.org \
    --cc=tomeu@tomeuvizoso.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.