From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 44CD036605A for ; Wed, 1 Jul 2026 17:15:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782926155; cv=none; b=AenARcZ5JL6xCSTRXAzfMH4IWXsHD+u+uxEKyOqr+7lBxU7znmOeUjTeG+3ODoU9mUNxVz38ewAefrDCYkIRkN4H0IhOsWneN92HtXgw5B30H70OakgAyLrwlnKq9Y5mCXbrlq6NBOPkkaD96Ji2lv4QGIippf7l1LEsV3Sgrzo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782926155; c=relaxed/simple; bh=oEd6cnkf0tY+dYsvh6YqBxKM3Uclyl17F0aXLYbM/cA=; h=Message-ID:Date:From:To:Cc:Subject:MIME-Version:Content-Type; b=P9dc0WOglqXM0Z/kC+rzOuVAUWAV4J5WmFY519MXkG6bi820DnEB2v0xLqJq3ARyRtMoawoiED7Fiy2D7oInYcJVy98Kbw2clnSCzmwRAcrF/L2rscLwE3cmrM5gR7v3DPUXlDPi1jU0COhmidPdekwbM2LbqTyCKU3Dps68CCI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dL/AoUek; arc=none smtp.client-ip=209.85.214.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dL/AoUek" Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2ca15944645so6554465ad.0 for ; Wed, 01 Jul 2026 10:15:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782926153; x=1783530953; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:subject:cc:to:from:date :message-id:from:to:cc:subject:date:message-id:reply-to; bh=kXHKpeSyKt3/ctGA9pi3psIMZ/frqZMmTniR+Nhu24E=; b=dL/AoUekAlOma8pyu8erDyDC4NqtY4NglIpKhNYxij0DFRLuTbcjT+sceBVzeRcJ6P DGGflfsatXe+nJW7hFK9UD3nYC/aEdOnaNVZqe2p8DmNLL3oKOLbrM8C/aCBNHFuLtnk uSOfuDZ5zCiKGfGYJw1+UBZElnH8DQkcm0H7Bel0gDR1YWBj8vFeZSthdU2RKjI/z4rQ NHuMQWwC2ELwlI85mee4y++Rxxq8TmIGMWm+Bv2JA1ILY7CbZOreF7SmknzQCHxbS585 eLeqp29Tv0E/LL9og2Bd5PDKgC8NrCVSYCTg8nnKD8SAQQoeTEOTwVXGBz6gHSxFY7mf ZyoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782926153; x=1783530953; h=content-transfer-encoding:mime-version:subject:cc:to:from:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=kXHKpeSyKt3/ctGA9pi3psIMZ/frqZMmTniR+Nhu24E=; b=aHDgyRsku8NezcChRG1u8gi3qR3rvjZ/tFKxshASztDAGQjgMFvflLyebC/b3rq0Xi ZWfJzIi98BbpRAm4jnT27k1BPg5T95ICIreZItJY0TfNb2vSiyiVoO57hMlNUECq2C0G xv0o7sbpglUCqeJSn8AGMds5w9flgbWaPfICMUIHiNHvlZ3v6T0OeUg/9GaXFfSfR9oc x5nAs9Aaap0TG+SLtAYZQZY9QoV0J963JijPl4bkHrhTUcxmOeqQyj/L+bqGDIrBJGRy K2mzqRSeXjr3VwR8yCJLG/Q3LIq8cgN7LzCojYedU7PtpR0MIdIQb91Ml33l6+OVh/Zr B8lQ== X-Forwarded-Encrypted: i=1; AHgh+RrHREoJQ+1IXKHlaXsLq/nJ+Y2j0yjAA9kstOQqRr6HtuJ118JqUK1cgIlTpKH8HE6MqpcwC2OirRVrKDA=@vger.kernel.org X-Gm-Message-State: AOJu0Ywy0SjyIX7FLrQkQ3pkIkzWDT6Ig+4Nk0fxUUniLp8hRswjsJ+r KBBNJklupoIyGZGwIPh6goXocbuIY9ea90QWEq8rW7Sf8aloR6ph5fkq X-Gm-Gg: AfdE7ck+y7pMeM4qGdkP5GKjVLnAo8XBTBZX0nRhJ1IR+skNMWhBcCIV179H33PUcGz jL2WFNqTKsXGm1CrR7kTxTjSux8p+kCSIfVB9pb/0GE/G8HZQTwuK7dsIPIbnj57CDwGdquQH9G l7KHJ7R4njdt/Okrf/Jv3Bo5BaHNdnT47lnG9c0Bg1CF8BpF0d6eCGEFs1xx0wcIaHGdwIbcHKi G0Om5gSHT1U+w4Pag8QdWObfuAqLluP36KkNpbo296kyNaF2L38P7nSxAQqNCzatO8egd0Rnbdm HhVT1knt+J/GQhsd4X/gZSl+L2mpH+IjcvMnF2ITuFrH/bmdWM0EbPzhSYay7DCcfq5RROd97jB fyMqprMhehYkhSs/TRWUNTyE1aPoOOwFWglrcJQ0BHcYYKGR5/sf+3ylAu+v9oeycfXvJSvCmhd a4C5Nmeu9hHc9v0e3C244ewhnzNY1RepX6szVKZTr+jeDQ3VmPmSSYrU6u9bEm4FlyB+ukWkhZH vuADQp8fv/8wVnlJOVx X-Received: by 2002:a17:903:3c50:b0:2ca:e5c:7fcf with SMTP id d9443c01a7336-2ca7e654686mr28663675ad.3.1782926153257; Wed, 01 Jul 2026 10:15:53 -0700 (PDT) Received: from Shuvs-MacBook-Air.local ([2407:1400:aa40:6780:6462:8b0c:2576:642b]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ca9aa38fc5sm1121895ad.4.2026.07.01.10.15.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Jul 2026 10:15:52 -0700 (PDT) Message-ID: <6a454b48.6a8fa39a.27019b.984b@mx.google.com> Date: Wed, 01 Jul 2026 10:15:52 -0700 (PDT) From: Shuvam Pandey To: Tomeu Vizoso Cc: Oded Gabbay , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] accel/rocket: initialize job domain before cleanup paths Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rocket_ioctl_submit_job() releases rjob through rocket_job_put() on allocation error paths. rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain), but job->domain is assigned only after task copying and BO lookups. A failure before that assignment can therefore clean up a job with a NULL domain pointer. Take the per-file domain reference before the first error path can release rjob. Also clear rjob->tasks after freeing it in rocket_copy_tasks(), so the common cleanup path cannot free the task array again after a task-copy error. Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Cc: stable@vger.kernel.org Signed-off-by: Shuvam Pandey --- drivers/accel/rocket/rocket_job.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c index 2f1861f960cc..2b7222afc197 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -102,6 +102,7 @@ rocket_copy_tasks(struct drm_device *dev, fail: kvfree(rjob->tasks); + rjob->tasks = NULL; return ret; } @@ -548,6 +549,7 @@ static int rocket_ioctl_submit_job(struct drm_device *dev, struct drm_file *file kref_init(&rjob->refcount); rjob->rdev = rdev; + rjob->domain = rocket_iommu_domain_get(file_priv); ret = drm_sched_job_init(&rjob->base, &file_priv->sched_entity, @@ -573,8 +575,6 @@ static int rocket_ioctl_submit_job(struct drm_device *dev, struct drm_file *file rjob->out_bo_count = job->out_bo_handle_count; - rjob->domain = rocket_iommu_domain_get(file_priv); - ret = rocket_job_push(rjob); if (ret) goto out_cleanup_job;