From: Max Zhen Date: Thu, 16 Apr 2026 20:11:06 +0000 (-0700) Subject: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer X-Git-Tag: v7.2-rc1~141^2~26^2~29 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=506255d46bdb93a281cf39e72abbca124f5c7a1b;p=thirdparty%2Flinux.git accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmt_chann has already been destroyed. Add NULL checks to xdna_mailbox_free_channel() and xdna_mailbox_stop_channel() so the cleanup path safely returns instead of dereferencing a NULL mailbox channel pointer. Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Max Zhen Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260416201106.1046072-1-lizhi.hou@amd.com --- diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c index 336e5e77f18a9..37771bdb24a17 100644 --- a/drivers/accel/amdxdna/amdxdna_mailbox.c +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c @@ -496,6 +496,9 @@ free_chann: void xdna_mailbox_free_channel(struct mailbox_channel *mb_chann) { + if (!mb_chann) + return; + destroy_workqueue(mb_chann->work_q); kfree(mb_chann); } @@ -542,6 +545,9 @@ void xdna_mailbox_stop_channel(struct mailbox_channel *mb_chann) struct mailbox_msg *mb_msg; unsigned long msg_id; + if (!mb_chann) + return; + /* Disable an irq and wait. This might sleep. */ free_irq(mb_chann->msix_irq, mb_chann);