In rocket_job_run(), after creating a fence at line 305 and taking an extra reference for job->done_fence at line 311 via dma_fence_get(), two error paths fail to release that extra reference before returning:

- Line 314: When pm_runtime_get_sync() fails, returns fence without putting job->done_fence.

- Line 318: When iommu_attach_group() fails, returns fence without putting job->done_fence, and also omits pm_runtime_put() to balance the successful pm_runtime_get_sync() at line 313.

The leaked fence reference prevents the fence and its underlying rocket device from being freed while job->done_fence still points to it. Repeated failures will accumulate leaked fences, consuming kernel memory and holding device resources indefinitely.

Fix both error paths by calling dma_fence_put(job->done_fence) and setting job->done_fence to NULL before returning. Also add the missing pm_runtime_put() on the iommu_attach_group error path.

Cc: stable@vger.kernel.org Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Signed-off-by: ZhaoJinming zhaojinming@uniontech.com --- drivers/accel/rocket/rocket_job.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c index ac51bff39833..66e4a1d57842 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -311,12 +311,19 @@ static struct dma_fence *rocket_job_run(struct drm_sched_job *sched_job) job->done_fence = dma_fence_get(fence);

ret = pm_runtime_get_sync(core->dev); - if (ret < 0) + if (ret < 0) { + dma_fence_put(job->done_fence); + job->done_fence = NULL; return fence; + }

ret = iommu_attach_group(job->domain->domain, core->iommu_group); - if (ret < 0) + if (ret < 0) { + pm_runtime_put(core->dev); + dma_fence_put(job->done_fence); + job->done_fence = NULL; return fence; + }

scoped_guard(mutex, &core->job_lock) { core->in_flight_job = job;