From: Dhabaleshwar Das Date: Wed, 28 May 2026 00:00:00 +0530 Subject: [PATCH 1/2] accel/rocket: Add NULL check for domain in rocket_job_cleanup() In rocket_ioctl_submit_job(), if rocket_copy_tasks() or drm_gem_objects_lookup() fails, the error path reaches rocket_job_cleanup() via rocket_job_put(). rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain), but job->domain is only assigned after all the fallible operations. Since the job struct is zeroed by kzalloc, job->domain is NULL on early failure, causing a NULL pointer dereference in rocket_iommu_domain_put() which calls kref_put() on a NULL pointer. Add a NULL check before calling rocket_iommu_domain_put(). Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Signed-off-by: Dhabaleshwar Das --- drivers/accel/rocket/rocket_job.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c index abcdef1..1234567 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -233,7 +233,8 @@ static void rocket_job_cleanup(struct kref *ref) struct rocket_job *job = container_of(ref, struct rocket_job, refcount); unsigned int i; - rocket_iommu_domain_put(job->domain); + if (job->domain) + rocket_iommu_domain_put(job->domain); dma_fence_put(job->done_fence); dma_fence_put(job->inference_done_fence);