On 10/4/2026 10:47 AM, Sidong Yang wrote:
drm_sched_init() cleans up after itself when it fails, but rocket_job_init() then calls drm_sched_fini() on the same scheduler. That wakes a wait queue that was never initialised, dereferencing a NULL pointer, and can destroy the submit workqueue a second time.Only destroy the reset workqueue on this path. Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Reported-by: Sashiko <[email protected]> Closes: https://lore.kernel.org/all/[email protected]/ Signed-off-by: Sidong Yang <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
