Subject: [PATCH 1/2] accel/rocket: Add NULL check for domain in rocket_job_cleanup()
From: Dhabaleshwar Das <[email-masked]>
Date: Wed, 28 May 2026 00:00:00 +0530

In rocket_ioctl_submit_job(), if rocket_copy_tasks() or
drm_gem_objects_lookup() fails, the error path reaches
rocket_job_cleanup() via rocket_job_put(). rocket_job_cleanup()
unconditionally calls rocket_iommu_domain_put(job->domain), but
job->domain is only assigned after all the fallible operations. Since
the job struct is zeroed by kzalloc, job->domain is NULL on early
failure, causing a NULL pointer dereference in
rocket_iommu_domain_put() which calls kref_put() on a NULL pointer.

Add a NULL check before calling rocket_iommu_domain_put().

Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Signed-off-by: Dhabaleshwar Das <[email-masked]>
---
 drivers/accel/rocket/rocket_job.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c
index abcdef1..1234567 100644
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -233,7 +233,8 @@ static void rocket_job_cleanup(struct kref *ref)
 	struct rocket_job *job = container_of(ref, struct rocket_job,
 						refcount);
 	unsigned int i;

-	rocket_iommu_domain_put(job->domain);
+	if (job->domain)
+		rocket_iommu_domain_put(job->domain);

 	dma_fence_put(job->done_fence);
 	dma_fence_put(job->inference_done_fence);