From 506255d46bdb93a281cf39e72abbca124f5c7a1b Mon Sep 17 00:00:00 2001 From: Max Zhen Date: Thu, 16 Apr 2026 13:11:06 -0700 Subject: [PATCH] accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmt_chann has already been destroyed. Add NULL checks to xdna_mailbox_free_channel() and xdna_mailbox_stop_channel() so the cleanup path safely returns instead of dereferencing a NULL mailbox channel pointer. Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Max Zhen Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260416201106.1046072-1-lizhi.hou@amd.com --- drivers/accel/amdxdna/amdxdna_mailbox.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c index 336e5e77f18a9..37771bdb24a17 100644 --- a/drivers/accel/amdxdna/amdxdna_mailbox.c +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c @@ -496,6 +496,9 @@ free_chann: void xdna_mailbox_free_channel(struct mailbox_channel *mb_chann) { + if (!mb_chann) + return; + destroy_workqueue(mb_chann->work_q); kfree(mb_chann); } @@ -542,6 +545,9 @@ void xdna_mailbox_stop_channel(struct mailbox_channel *mb_chann) struct mailbox_msg *mb_msg; unsigned long msg_id; + if (!mb_chann) + return; + /* Disable an irq and wait. This might sleep. */ free_irq(mb_chann->msix_irq, mb_chann); -- 2.47.3