Hi Jiaxing, Thanks - that is exactly the kind of hole a reviewer is for. You were right on all three counts: the failure path left the slot marked live, and the live-slot walk in rocket_job_open() could then write one entry past its allocation.
v2 is out with all three addressed: https://lore.kernel.org/dri-devel/[email protected]/ I also exercised the path you described on RK3588 - a forced error return in rocket_core_init() for core 2 with cores 0 and 1 bound: the slot is released, the device comes up with the two remaining cores, and inference passes bit-exact with only the two live cores' interrupts firing. Thanks again for the careful review, Igor
