drm_sched_init() cleans up after itself when it fails, but
rocket_job_init() then calls drm_sched_fini() on the same scheduler.
That wakes a wait queue that was never initialised, dereferencing a
NULL pointer, and can destroy the submit workqueue a second time.
Only destroy the reset workqueue on this path.
Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Reported-by: Sashiko <[email protected]>
Closes: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Sidong Yang <[email protected]>
---
drivers/accel/rocket/rocket_job.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/accel/rocket/rocket_job.c
b/drivers/accel/rocket/rocket_job.c
index f40435505818..319365ad7976 100644
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -494,8 +494,6 @@ int rocket_job_init(struct rocket_core *core)
return 0;
err_sched:
- drm_sched_fini(&core->sched);
-
destroy_workqueue(core->reset.wq);
return ret;
}
--
2.53.0
