* [PATCH V1] accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer
@ 2026-04-16 20:11 Lizhi Hou
2026-04-16 22:46 ` Mario Limonciello
0 siblings, 1 reply; 3+ messages in thread
From: Lizhi Hou @ 2026-04-16 20:11 UTC (permalink / raw)
To: ogabbay, quic_jhugo, dri-devel, mario.limonciello,
maciej.falkowski
Cc: Max Zhen, linux-kernel, sonal.santan, Lizhi Hou
From: Max Zhen <max.zhen@amd.com>
The management mailbox channel cleanup helpers can be called from
error handling paths when mgmt_chann has already been destroyed.
Add NULL checks to xdna_mailbox_free_channel() and
xdna_mailbox_stop_channel() so the cleanup path safely returns instead
of dereferencing a NULL mailbox channel pointer.
Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox")
Signed-off-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
drivers/accel/amdxdna/amdxdna_mailbox.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
index 336e5e77f18a..37771bdb24a1 100644
--- a/drivers/accel/amdxdna/amdxdna_mailbox.c
+++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
@@ -496,6 +496,9 @@ struct mailbox_channel *xdna_mailbox_alloc_channel(struct mailbox *mb)
void xdna_mailbox_free_channel(struct mailbox_channel *mb_chann)
{
+ if (!mb_chann)
+ return;
+
destroy_workqueue(mb_chann->work_q);
kfree(mb_chann);
}
@@ -542,6 +545,9 @@ void xdna_mailbox_stop_channel(struct mailbox_channel *mb_chann)
struct mailbox_msg *mb_msg;
unsigned long msg_id;
+ if (!mb_chann)
+ return;
+
/* Disable an irq and wait. This might sleep. */
free_irq(mb_chann->msix_irq, mb_chann);
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH V1] accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer
2026-04-16 20:11 [PATCH V1] accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer Lizhi Hou
@ 2026-04-16 22:46 ` Mario Limonciello
2026-04-17 16:18 ` Lizhi Hou
0 siblings, 1 reply; 3+ messages in thread
From: Mario Limonciello @ 2026-04-16 22:46 UTC (permalink / raw)
To: Lizhi Hou, ogabbay, quic_jhugo, dri-devel, maciej.falkowski
Cc: Max Zhen, linux-kernel, sonal.santan
On 4/16/26 15:11, Lizhi Hou wrote:
> From: Max Zhen <max.zhen@amd.com>
>
> The management mailbox channel cleanup helpers can be called from
> error handling paths when mgmt_chann has already been destroyed.
>
> Add NULL checks to xdna_mailbox_free_channel() and
> xdna_mailbox_stop_channel() so the cleanup path safely returns instead
> of dereferencing a NULL mailbox channel pointer.
>
> Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox")
> Signed-off-by: Max Zhen <max.zhen@amd.com>
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> ---
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
> drivers/accel/amdxdna/amdxdna_mailbox.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
> index 336e5e77f18a..37771bdb24a1 100644
> --- a/drivers/accel/amdxdna/amdxdna_mailbox.c
> +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
> @@ -496,6 +496,9 @@ struct mailbox_channel *xdna_mailbox_alloc_channel(struct mailbox *mb)
>
> void xdna_mailbox_free_channel(struct mailbox_channel *mb_chann)
> {
> + if (!mb_chann)
> + return;
> +
> destroy_workqueue(mb_chann->work_q);
> kfree(mb_chann);
> }
> @@ -542,6 +545,9 @@ void xdna_mailbox_stop_channel(struct mailbox_channel *mb_chann)
> struct mailbox_msg *mb_msg;
> unsigned long msg_id;
>
> + if (!mb_chann)
> + return;
> +
> /* Disable an irq and wait. This might sleep. */
> free_irq(mb_chann->msix_irq, mb_chann);
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH V1] accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer
2026-04-16 22:46 ` Mario Limonciello
@ 2026-04-17 16:18 ` Lizhi Hou
0 siblings, 0 replies; 3+ messages in thread
From: Lizhi Hou @ 2026-04-17 16:18 UTC (permalink / raw)
To: Mario Limonciello, ogabbay, quic_jhugo, dri-devel,
maciej.falkowski
Cc: Max Zhen, linux-kernel, sonal.santan
Applied to drm-misc-next
On 4/16/26 15:46, Mario Limonciello wrote:
>
>
> On 4/16/26 15:11, Lizhi Hou wrote:
>> From: Max Zhen <max.zhen@amd.com>
>>
>> The management mailbox channel cleanup helpers can be called from
>> error handling paths when mgmt_chann has already been destroyed.
>>
>> Add NULL checks to xdna_mailbox_free_channel() and
>> xdna_mailbox_stop_channel() so the cleanup path safely returns instead
>> of dereferencing a NULL mailbox channel pointer.
>>
>> Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox")
>> Signed-off-by: Max Zhen <max.zhen@amd.com>
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
>> ---
> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
>> drivers/accel/amdxdna/amdxdna_mailbox.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c
>> b/drivers/accel/amdxdna/amdxdna_mailbox.c
>> index 336e5e77f18a..37771bdb24a1 100644
>> --- a/drivers/accel/amdxdna/amdxdna_mailbox.c
>> +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
>> @@ -496,6 +496,9 @@ struct mailbox_channel
>> *xdna_mailbox_alloc_channel(struct mailbox *mb)
>> void xdna_mailbox_free_channel(struct mailbox_channel *mb_chann)
>> {
>> + if (!mb_chann)
>> + return;
>> +
>> destroy_workqueue(mb_chann->work_q);
>> kfree(mb_chann);
>> }
>> @@ -542,6 +545,9 @@ void xdna_mailbox_stop_channel(struct
>> mailbox_channel *mb_chann)
>> struct mailbox_msg *mb_msg;
>> unsigned long msg_id;
>> + if (!mb_chann)
>> + return;
>> +
>> /* Disable an irq and wait. This might sleep. */
>> free_irq(mb_chann->msix_irq, mb_chann);
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-17 16:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-16 20:11 [PATCH V1] accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer Lizhi Hou
2026-04-16 22:46 ` Mario Limonciello
2026-04-17 16:18 ` Lizhi Hou
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox