From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E049331A062 for ; Thu, 16 Apr 2026 22:46:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776379564; cv=none; b=oxS23P4LtsNKw8/n4HCzUWluLD7CqH/jor1uFaz8S2/ZX61b7uZWiflR4ySbV1oolr5dhneC0aKbcTvRx2IRNlFP1FG5Am/0Mr3xdANALgeLmcAE2O5fdU68ByhbW3rnGYr1HVsbwSIa55bFDXBfkZKL6iriPF5iDPD/bReGv5k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776379564; c=relaxed/simple; bh=toFQ5MEaMuNnsmV2mgoZVE1Hdneebn4aDRb7hpWdMnk=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=WUcSLT52spLagOZAMRqiqCwtwibIFoksGN6T6O9ua6R1OYOJ0FdvhtsVabdPaJGaerTB4FloxbT0oYPEAevTnxTCimhR6efEl5+v0KgmOyGHKyQvJhLWIoLSld46MtEKs3kzaQXPKvQrdUIoL5swQTK0vkk68NOFvB2+HFEQ58E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RqVzKkuh; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RqVzKkuh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10DDBC2BCAF; Thu, 16 Apr 2026 22:46:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776379564; bh=toFQ5MEaMuNnsmV2mgoZVE1Hdneebn4aDRb7hpWdMnk=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=RqVzKkuhIEsNJfUtSMs118ZKuIMcm6qUq1wWA4yvFpHRqDoihblVaF6oW+1nPQV4l v+iEZBdU0Qps3oV9tki7NJtzPUhVoFiEUGRaiUyocHA/99Uk9aB2S0dbuKAok0j5pe MMkPpGO8fyrclpeXyqM63ljzjtl/u1BX2CFesGiAPDlS51aNnX3KD6zcLICAxFMaMt mCXJLjnwhjQxSdjuePgGkk/t2k3cwrZOMPqrD//n6FYr38oVWsi9NyjEn00h0f9m0Q PQrzrBn2K7s0+VNUoRti0kcMjx0eG7t0vEMis/wIghzDiRuXxlfdLS6+37J3sNlpto jnlvCITqpkRiw== Message-ID: Date: Thu, 16 Apr 2026 17:46:00 -0500 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH V1] accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer Content-Language: en-US To: Lizhi Hou , ogabbay@kernel.org, quic_jhugo@quicinc.com, dri-devel@lists.freedesktop.org, maciej.falkowski@linux.intel.com Cc: Max Zhen , linux-kernel@vger.kernel.org, sonal.santan@amd.com References: <20260416201106.1046072-1-lizhi.hou@amd.com> From: Mario Limonciello In-Reply-To: <20260416201106.1046072-1-lizhi.hou@amd.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 4/16/26 15:11, Lizhi Hou wrote: > From: Max Zhen > > The management mailbox channel cleanup helpers can be called from > error handling paths when mgmt_chann has already been destroyed. > > Add NULL checks to xdna_mailbox_free_channel() and > xdna_mailbox_stop_channel() so the cleanup path safely returns instead > of dereferencing a NULL mailbox channel pointer. > > Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") > Signed-off-by: Max Zhen > Signed-off-by: Lizhi Hou > --- Reviewed-by: Mario Limonciello (AMD) > drivers/accel/amdxdna/amdxdna_mailbox.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c > index 336e5e77f18a..37771bdb24a1 100644 > --- a/drivers/accel/amdxdna/amdxdna_mailbox.c > +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c > @@ -496,6 +496,9 @@ struct mailbox_channel *xdna_mailbox_alloc_channel(struct mailbox *mb) > > void xdna_mailbox_free_channel(struct mailbox_channel *mb_chann) > { > + if (!mb_chann) > + return; > + > destroy_workqueue(mb_chann->work_q); > kfree(mb_chann); > } > @@ -542,6 +545,9 @@ void xdna_mailbox_stop_channel(struct mailbox_channel *mb_chann) > struct mailbox_msg *mb_msg; > unsigned long msg_id; > > + if (!mb_chann) > + return; > + > /* Disable an irq and wait. This might sleep. */ > free_irq(mb_chann->msix_irq, mb_chann); >