Skip to content

Commit a631770

Browse files
houlz0507Sasha Levin
authored andcommitted
accel/amdxdna: Fix crash when destroying a suspended hardware context
[ Upstream commit 8363c02 ] If userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, the driver may crash because the mailbox channel pointer is NULL for the suspended context. Fix this by checking the mailbox channel pointer in aie2_destroy_context() before accessing it. Fixes: 97f2757 ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup") Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260206060306.4050531-1-lizhi.hou@amd.com Signed-off-by: Sasha Levin <sashal@kernel.org>
1 parent f2360a4 commit a631770

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

drivers/accel/amdxdna/aie2_message.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,9 @@ int aie2_destroy_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwc
274274
struct amdxdna_dev *xdna = ndev->xdna;
275275
int ret;
276276

277+
if (!hwctx->priv->mbox_chann)
278+
return 0;
279+
277280
xdna_mailbox_stop_channel(hwctx->priv->mbox_chann);
278281
ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
279282
xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann);

0 commit comments

Comments
 (0)