remoteproc: xlnx: Only access buffer information if IPI is buffered

In the receive callback check if message is NULL to prevent
possibility of crash by NULL pointer dereferencing.

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Fixes: 5dfb28c257b7 ("remoteproc: xilinx: Add mailbox channels for rpmsg")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20260303235127.2317955-3-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>

diff --git a/drivers/remoteproc/xlnx_r5_remoteproc.c b/drivers/remoteproc/xlnx_r5_remoteproc.c
index 148d8c622566dd7b969f59002a874743068ee795..5e92dc51f1c082e53fd0698d052384e61e6003f5 100644 (file)
--- a/drivers/remoteproc/xlnx_r5_remoteproc.c
+++ b/drivers/remoteproc/xlnx_r5_remoteproc.c
@@ -232,17 +232,19 @@ static void zynqmp_r5_mb_rx_cb(struct mbox_client *cl, void *msg)
 
        ipi = container_of(cl, struct mbox_info, mbox_cl);
 
-       /* copy data from ipi buffer to r5_core */
+       /* copy data from ipi buffer to r5_core if IPI is buffered. */
        ipi_msg = (struct zynqmp_ipi_message *)msg;
-       buf_msg = (struct zynqmp_ipi_message *)ipi->rx_mc_buf;
-       len = ipi_msg->len;
-       if (len > IPI_BUF_LEN_MAX) {
-               dev_warn(cl->dev, "msg size exceeded than %d\n",
-                        IPI_BUF_LEN_MAX);
-               len = IPI_BUF_LEN_MAX;
+       if (ipi_msg) {
+               buf_msg = (struct zynqmp_ipi_message *)ipi->rx_mc_buf;
+               len = ipi_msg->len;
+               if (len > IPI_BUF_LEN_MAX) {
+                       dev_warn(cl->dev, "msg size exceeded than %d\n",
+                                IPI_BUF_LEN_MAX);
+                       len = IPI_BUF_LEN_MAX;
+               }
+               buf_msg->len = len;
+               memcpy(buf_msg->data, ipi_msg->data, len);
        }
-       buf_msg->len = len;
-       memcpy(buf_msg->data, ipi_msg->data, len);
 
        /* received and processed interrupt ack */
        if (mbox_send_message(ipi->rx_chan, NULL) < 0)