[PATCH] accel/amdxdna: fix IRQ vector leak in aie2_init()

[PATCH] accel/amdxdna: fix IRQ vector leak in aie2_init()

[Guangshuo Li]

aie2_init() allocates MSI-X vectors with pci_alloc_irq_vectors() before
creating the PSP handle, starting the hardware and initializing the
resolver.

When aie2m_psp_create(), aie2_hw_start() or xrsm_init() fails after IRQ
vectors have been allocated successfully, the function releases the
firmware and unwinds hardware state, but fails to free the allocated
IRQ vectors.

The issue was identified by a static analysis tool I developed and
confirmed by manual review. Add a dedicated error path to free the IRQ
vectors after pci_alloc_irq_vectors() succeeds.

Fixes: 8c9ff1b181ba ("accel/amdxdna: Add a new driver for AMD AI Engine")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/accel/amdxdna/aie2_pci.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
index 4924a9da55b6..f05f49f691b5 100644
--- a/drivers/accel/amdxdna/aie2_pci.c
+++ b/drivers/accel/amdxdna/aie2_pci.c
@@ -591,14 +591,14 @@ static int aie2_init(struct amdxdna_dev *xdna)
 	if (!ndev->psp_hdl) {
 		XDNA_ERR(xdna, "failed to create psp");
 		ret = -ENOMEM;
-		goto release_fw;
+		goto free_irq_vectors;
 	}
 	xdna->dev_handle = ndev;
 
 	ret = aie2_hw_start(xdna);
 	if (ret) {
 		XDNA_ERR(xdna, "start npu failed, ret %d", ret);
-		goto release_fw;
+		goto free_irq_vectors;
 	}
 
 	xrs_cfg.clk_list.num_levels = ndev->max_dpm_level + 1;
@@ -623,6 +623,8 @@ static int aie2_init(struct amdxdna_dev *xdna)
 
 stop_hw:
 	aie2_hw_stop(xdna);
+free_irq_vectors:
+	pci_free_irq_vectors(pdev);
 release_fw:
 	release_firmware(fw);
 
-- 
2.43.0

Re: [PATCH] accel/amdxdna: fix IRQ vector leak in aie2_init()

[Lizhi Hou]

On 4/14/26 05:10, Guangshuo Li wrote:
> [You don't often get email from lgs201920130244@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> aie2_init() allocates MSI-X vectors with pci_alloc_irq_vectors() before
> creating the PSP handle, starting the hardware and initializing the
> resolver.
>
> When aie2m_psp_create(), aie2_hw_start() or xrsm_init() fails after IRQ
> vectors have been allocated successfully, the function releases the
> firmware and unwinds hardware state, but fails to free the allocated
> IRQ vectors.

aie2_init enables device via pcim_enable_device(), which sets managed 
device. Thus the vectors are automatically cleanup. So NAK.


Lizhi

>
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review. Add a dedicated error path to free the IRQ
> vectors after pci_alloc_irq_vectors() succeeds.
>
> Fixes: 8c9ff1b181ba ("accel/amdxdna: Add a new driver for AMD AI Engine")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>   drivers/accel/amdxdna/aie2_pci.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
> index 4924a9da55b6..f05f49f691b5 100644
> --- a/drivers/accel/amdxdna/aie2_pci.c
> +++ b/drivers/accel/amdxdna/aie2_pci.c
> @@ -591,14 +591,14 @@ static int aie2_init(struct amdxdna_dev *xdna)
>          if (!ndev->psp_hdl) {
>                  XDNA_ERR(xdna, "failed to create psp");
>                  ret = -ENOMEM;
> -               goto release_fw;
> +               goto free_irq_vectors;
>          }
>          xdna->dev_handle = ndev;
>
>          ret = aie2_hw_start(xdna);
>          if (ret) {
>                  XDNA_ERR(xdna, "start npu failed, ret %d", ret);
> -               goto release_fw;
> +               goto free_irq_vectors;
>          }
>
>          xrs_cfg.clk_list.num_levels = ndev->max_dpm_level + 1;
> @@ -623,6 +623,8 @@ static int aie2_init(struct amdxdna_dev *xdna)
>
>   stop_hw:
>          aie2_hw_stop(xdna);
> +free_irq_vectors:
> +       pci_free_irq_vectors(pdev);
>   release_fw:
>          release_firmware(fw);
>
> --
> 2.43.0
>

Re: [PATCH] accel/amdxdna: fix IRQ vector leak in aie2_init()

[Guangshuo Li]

Hello,

Thanks for reviewing.

On Wed, 15 Apr 2026 at 00:06, Lizhi Hou <lizhi.hou@amd.com> wrote:
>
>

>
> aie2_init enables device via pcim_enable_device(), which sets managed
> device. Thus the vectors are automatically cleanup. So NAK.
>
>
> Lizhi
>

Sorry, I missed that pcim_enable_device() already makes the device
managed, so the IRQ vectors are cleaned up automatically. Thanks for
pointing it out.

Best regards,
Guangshuo