From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C2A5C2D73B6 for ; Fri, 6 Feb 2026 06:52:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.16 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770360780; cv=none; b=FFB+D5pmVTWVnRUFNzDIjRpOgTXh95GnvLvxihPUnIWQPThXeqLq68JZYhPHy9njNWtZMO7tW1MLqjn3g4Y6ko9NkJl0m0ezPIrj96t4V0BB6nwLnxiuizfX2GC4aJtThIcHbLmO3Zec8C4SMsEKCa1V+VnG8Kap5ia9sxc3y1w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770360780; c=relaxed/simple; bh=vVplapJSbFm1IK1Saw/+Hqb9xTPdx04X6rW/ESSYKfM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=X+smn7B8lxb+b7HotpjxwgrZKT+w8eyI46jLkE2+x6WvtelWZlGJyU1g8Xq0zKI8ri3E26iAp2hyLU1awOgWKGe1HrrDQELu7sx5IWcHzE1G7jkymbpNdPBYlZTEn4JvikPjdfFlEEqsPgSbpys6B4FxwckKjfy4bq3eGschOwc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Zvyu1viv; arc=none smtp.client-ip=192.198.163.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Zvyu1viv" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1770360780; x=1801896780; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=vVplapJSbFm1IK1Saw/+Hqb9xTPdx04X6rW/ESSYKfM=; b=Zvyu1vivMBUrk0+vl4V44YGabm/RL0GgEjqO8ZcP+HIq2Ldx/Yg3kLZ4 axVCnvAK2GXsApCmI4tI1r/RVLnv5Jwg5fxLwFx6ulswMCt1p+PLKCIRX j6H4NYULJLmVtPDLqq+76UWcWsyvhw/7pkGE75wFUEGacI3rSVO/GMsNQ ik65jDHOggeIE2LfGmfMG4GRJMmIO1ZmGL4mzcju/lCuo42x7nJ9CLGd8 AUY+vwNanre+LtajZC4wOiFywwbMERs4sPAQml8RqDjPFIUdkZtTZv7H2 vSl0b7Z7iNTuOos1K2DP3rGRhfYJFcL+auIP1vXcAyljNuuQKOLihAyG1 w==; X-CSE-ConnectionGUID: Dkm9EtOCTMODuX32nRIM6w== X-CSE-MsgGUID: VkgvBs2IT7yt3kh2b/h3IQ== X-IronPort-AV: E=McAfee;i="6800,10657,11692"; a="59140148" X-IronPort-AV: E=Sophos;i="6.21,275,1763452800"; d="scan'208";a="59140148" Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Feb 2026 22:52:59 -0800 X-CSE-ConnectionGUID: ehDad1CxT9GlcGP+i1kZYA== X-CSE-MsgGUID: 0BB+BCL3SwmXmiwjnzuB4w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.21,275,1763452800"; d="scan'208";a="210632100" Received: from nmizonov-mobl2.ccr.corp.intel.com (HELO [10.246.19.19]) ([10.246.19.19]) by fmviesa010-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Feb 2026 22:52:57 -0800 Message-ID: <66a231b3-3335-4e65-b38f-ff1fa9ec8f2b@linux.intel.com> Date: Fri, 6 Feb 2026 07:52:40 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH V1] accel/amdxdna: Fix crash when destroying a suspended hardware context To: Lizhi Hou , ogabbay@kernel.org, quic_jhugo@quicinc.com, dri-devel@lists.freedesktop.org, maciej.falkowski@linux.intel.com Cc: linux-kernel@vger.kernel.org, max.zhen@amd.com, sonal.santan@amd.com, mario.limonciello@amd.com References: <20260206060306.4050531-1-lizhi.hou@amd.com> Content-Language: en-US From: Karol Wachowski Organization: Intel Technology Poland sp. z o.o. - ul. Slowackiego 173, 80-298 Gdansk - KRS 101882 - NIP 957-07-52-316 In-Reply-To: <20260206060306.4050531-1-lizhi.hou@amd.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 2/6/2026 7:03 AM, Lizhi Hou wrote: > If userspace issues an ioctl to destroy a hardware context that has > already been automatically suspended, the driver may crash because the > mailbox channel pointer is NULL for the suspended context. > > Fix this by checking the mailbox channel pointer in aie2_destroy_context() > before accessing it. > > Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup") > Signed-off-by: Lizhi Hou > --- > drivers/accel/amdxdna/aie2_message.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c > index 7d7dcfeaf794..ab1178850c47 100644 > --- a/drivers/accel/amdxdna/aie2_message.c > +++ b/drivers/accel/amdxdna/aie2_message.c > @@ -318,6 +318,9 @@ int aie2_destroy_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwc > struct amdxdna_dev *xdna = ndev->xdna; > int ret; > > + if (!hwctx->priv->mbox_chann) > + return 0; > + > xdna_mailbox_stop_channel(hwctx->priv->mbox_chann); > ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id); > xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann); Reviewed-by: Karol Wachowski