* [PATCH V1] accel/amdxdna: Fix crash when destroying a suspended hardware context
@ 2026-02-06 6:03 Lizhi Hou
2026-02-06 6:52 ` Karol Wachowski
0 siblings, 1 reply; 2+ messages in thread
From: Lizhi Hou @ 2026-02-06 6:03 UTC (permalink / raw)
To: ogabbay, quic_jhugo, dri-devel, maciej.falkowski
Cc: Lizhi Hou, linux-kernel, max.zhen, sonal.santan, mario.limonciello
If userspace issues an ioctl to destroy a hardware context that has
already been automatically suspended, the driver may crash because the
mailbox channel pointer is NULL for the suspended context.
Fix this by checking the mailbox channel pointer in aie2_destroy_context()
before accessing it.
Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
drivers/accel/amdxdna/aie2_message.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c
index 7d7dcfeaf794..ab1178850c47 100644
--- a/drivers/accel/amdxdna/aie2_message.c
+++ b/drivers/accel/amdxdna/aie2_message.c
@@ -318,6 +318,9 @@ int aie2_destroy_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwc
struct amdxdna_dev *xdna = ndev->xdna;
int ret;
+ if (!hwctx->priv->mbox_chann)
+ return 0;
+
xdna_mailbox_stop_channel(hwctx->priv->mbox_chann);
ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann);
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH V1] accel/amdxdna: Fix crash when destroying a suspended hardware context
2026-02-06 6:03 [PATCH V1] accel/amdxdna: Fix crash when destroying a suspended hardware context Lizhi Hou
@ 2026-02-06 6:52 ` Karol Wachowski
0 siblings, 0 replies; 2+ messages in thread
From: Karol Wachowski @ 2026-02-06 6:52 UTC (permalink / raw)
To: Lizhi Hou, ogabbay, quic_jhugo, dri-devel, maciej.falkowski
Cc: linux-kernel, max.zhen, sonal.santan, mario.limonciello
On 2/6/2026 7:03 AM, Lizhi Hou wrote:
> If userspace issues an ioctl to destroy a hardware context that has
> already been automatically suspended, the driver may crash because the
> mailbox channel pointer is NULL for the suspended context.
>
> Fix this by checking the mailbox channel pointer in aie2_destroy_context()
> before accessing it.
>
> Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> ---
> drivers/accel/amdxdna/aie2_message.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c
> index 7d7dcfeaf794..ab1178850c47 100644
> --- a/drivers/accel/amdxdna/aie2_message.c
> +++ b/drivers/accel/amdxdna/aie2_message.c
> @@ -318,6 +318,9 @@ int aie2_destroy_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwc
> struct amdxdna_dev *xdna = ndev->xdna;
> int ret;
>
> + if (!hwctx->priv->mbox_chann)
> + return 0;
> +
> xdna_mailbox_stop_channel(hwctx->priv->mbox_chann);
> ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
> xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann);
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-02-06 6:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-02-06 6:03 [PATCH V1] accel/amdxdna: Fix crash when destroying a suspended hardware context Lizhi Hou
2026-02-06 6:52 ` Karol Wachowski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®