diff options
| author | Lizhi Hou <lizhi.hou@amd.com> | 2026-02-06 09:03:06 +0300 |
|---|---|---|
| committer | Lizhi Hou <lizhi.hou@amd.com> | 2026-02-23 20:24:15 +0300 |
| commit | 8363c02863332992a1822688da41f881d88d1631 (patch) | |
| tree | 8ffd3ebe39e8407e13c9472118e3cfc04cb53398 | |
| parent | c68a6af400ca80596e8c37de0a1cb564aa9da8a4 (diff) | |
| download | linux-8363c02863332992a1822688da41f881d88d1631.tar.xz | |
accel/amdxdna: Fix crash when destroying a suspended hardware context
If userspace issues an ioctl to destroy a hardware context that has
already been automatically suspended, the driver may crash because the
mailbox channel pointer is NULL for the suspended context.
Fix this by checking the mailbox channel pointer in aie2_destroy_context()
before accessing it.
Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup")
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260206060306.4050531-1-lizhi.hou@amd.com
| -rw-r--r-- | drivers/accel/amdxdna/aie2_message.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c index 7d7dcfeaf794..ab1178850c47 100644 --- a/drivers/accel/amdxdna/aie2_message.c +++ b/drivers/accel/amdxdna/aie2_message.c @@ -318,6 +318,9 @@ int aie2_destroy_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwc struct amdxdna_dev *xdna = ndev->xdna; int ret; + if (!hwctx->priv->mbox_chann) + return 0; + xdna_mailbox_stop_channel(hwctx->priv->mbox_chann); ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id); xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann); |