6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guangshuo Li [ Upstream commit 4ac852419f0d317c7bd8db5b8acb3cc78be7fe33 ] rocket_probe() stores the return value from rocket_device_init() in the file-scoped rdev pointer before checking whether it is an error pointer. If rocket_device_init() fails, rdev is left as an ERR_PTR. The rdev pointer is also used as the marker for whether the shared rocket device has already been initialized. A later core probe can therefore see a non-NULL rdev, skip rocket_device_init(), and dereference the error pointer when reading rdev->num_cores. Save the error code and clear rdev before returning from the rocket_device_init() failure path. Fixes: ed98261b4168 ("accel/rocket: Add a new driver for Rockchip's NPU") Signed-off-by: Guangshuo Li Reviewed-by: Igor Paunovic Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260708062845.716487-1-lgs201920130244@gmail.com Signed-off-by: Sasha Levin --- drivers/accel/rocket/rocket_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/accel/rocket/rocket_drv.c b/drivers/accel/rocket/rocket_drv.c index f6ef4c7aeef11..3c4330f2f3ae8 100644 --- a/drivers/accel/rocket/rocket_drv.c +++ b/drivers/accel/rocket/rocket_drv.c @@ -165,8 +165,11 @@ static int rocket_probe(struct platform_device *pdev) /* First core probing, initialize DRM device. */ rdev = rocket_device_init(drm_dev, &rocket_drm_driver); if (IS_ERR(rdev)) { + int err = PTR_ERR(rdev); + dev_err(&pdev->dev, "failed to initialize rocket device\n"); - return PTR_ERR(rdev); + rdev = NULL; + return err; } } -- 2.53.0