[PATCH v2 1/3] accel/rocket: Don't tear down the scheduler when drm_sched_init() fails

From: Sidong Yang

Date: Sun Oct 04 2026 - 12:53:52 EST


drm_sched_init() cleans up after itself when it fails, but
rocket_job_init() then calls drm_sched_fini() on the same scheduler.
That wakes a wait queue that was never initialised, dereferencing a
NULL pointer, and can destroy the submit workqueue a second time.

Only destroy the reset workqueue on this path.

Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Closes: https://lore.kernel.org/all/20260912114524.7A6131F00893@xxxxxxxxxxxxxxx/
Signed-off-by: Sidong Yang <sidong.yang@xxxxxxxxxx>
---
drivers/accel/rocket/rocket_job.c | 2 --
1 file changed, 2 deletions(-)

diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c
index f40435505818..319365ad7976 100644
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -494,8 +494,6 @@ int rocket_job_init(struct rocket_core *core)
return 0;

err_sched:
- drm_sched_fini(&core->sched);
-
destroy_workqueue(core->reset.wq);
return ret;
}
--
2.53.0