accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer

The management mailbox channel cleanup helpers can be called from
error handling paths when mgmt_chann has already been destroyed.

Add NULL checks to xdna_mailbox_free_channel() and
xdna_mailbox_stop_channel() so the cleanup path safely returns instead
of dereferencing a NULL mailbox channel pointer.

Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260416201106.1046072-1-lizhi.hou@amd.com

diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
index 336e5e77f18a97f632784b72b8c33070a83cc3c9..37771bdb24a178bc1aa21860163022f94790d3bf 100644 (file)
--- a/drivers/accel/amdxdna/amdxdna_mailbox.c
+++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
@@ -496,6 +496,9 @@ free_chann:
 
 void xdna_mailbox_free_channel(struct mailbox_channel *mb_chann)
 {
+       if (!mb_chann)
+               return;
+
        destroy_workqueue(mb_chann->work_q);
        kfree(mb_chann);
 }
@@ -542,6 +545,9 @@ void xdna_mailbox_stop_channel(struct mailbox_channel *mb_chann)
        struct mailbox_msg *mb_msg;
        unsigned long msg_id;
 
+       if (!mb_chann)
+               return;
+
        /* Disable an irq and wait. This might sleep. */
        free_irq(mb_chann->msix_irq, mb_chann);