Skip to content

Commit 8363c02

Browse files
committed
accel/amdxdna: Fix crash when destroying a suspended hardware context
If userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, the driver may crash because the mailbox channel pointer is NULL for the suspended context. Fix this by checking the mailbox channel pointer in aie2_destroy_context() before accessing it. Fixes: 97f2757 ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup") Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260206060306.4050531-1-lizhi.hou@amd.com
1 parent c68a6af commit 8363c02

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

drivers/accel/amdxdna/aie2_message.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -318,6 +318,9 @@ int aie2_destroy_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwc
318318
struct amdxdna_dev *xdna = ndev->xdna;
319319
int ret;
320320

321+
if (!hwctx->priv->mbox_chann)
322+
return 0;
323+
321324
xdna_mailbox_stop_channel(hwctx->priv->mbox_chann);
322325
ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
323326
xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann);

0 commit comments

Comments
 (0)