From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id E3E81248886 for ; Fri, 20 Mar 2026 06:06:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773986796; cv=none; b=OkcNiT8w7AN4WT0OCvQKHpJrx5YKdhth6PYaPv6BFAF3hWgffuppkwcBk+e6wy76UTKZ18f2Yiylwicli+bHY4iuY7UtjrxPXjm6DRY/SNjqBL07JNK1KD8F/TaAyQ7NwrJPLHz79vZk9DcSbE4yV1ovNGCA1cF2LKIIekQYBGo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773986796; c=relaxed/simple; bh=RRWbDy4aokNN1FBCyDC24pvrbG4ZR4OHbcn8V0Rm6fU=; h=Message-ID:Date:MIME-Version:Subject:To:References:From: In-Reply-To:Content-Type; b=st5V/pA1S/SB0y4vpZAkU9ZjFib6L3Cx/NSO1V473c2Hi/Icbdf5Tltl6BV62SAyOehfP/3zalFz8VeeZORbJ3YntigBc6cnKr2Km0XfUVmOodMsbAsAFlTxojKwL7sAIe9vrY6/sQsslpgS5ENqSxAQhDUXminxN9CEKTEmNeA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=EJV3r3Bk; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="EJV3r3Bk" Received: from [10.94.176.97] (unknown [4.194.122.162]) by linux.microsoft.com (Postfix) with ESMTPSA id A8F9920B710C; Thu, 19 Mar 2026 23:06:33 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com A8F9920B710C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1773986795; bh=6PIzdafjN7WCYYuCQALUYYZgX3e21Tqrr/6yaH1Xmd4=; h=Date:Subject:To:References:From:In-Reply-To:From; b=EJV3r3BkpE7aJTbBal2JjdirNnfl+n5AorOuHd2tLfUqLlnVv3mB/PUltJStlToSY hxXjfdZNbFf0eOyEE4zBh7bWcKM5LeEZPjI5/EroW/dpHHbbQYh7AhnGCvfvu5rKEM WiXs/OKebvVAVI8IDwqCuXPW7HEa/Ufut6tr72uQ= Message-ID: Date: Fri, 20 Mar 2026 11:36:31 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 2/2] soc: xilinx: Shutdown and free rx mailbox channel To: Michal Simek , jay.buddhabhatti@amd.com, marco.crivellari@suse.com, tejas.patel@xilinx.com, rajan.vaja@xilinx.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org References: <20260317133517.1324319-1-ptsm@linux.microsoft.com> <20260317143643.1329013-1-ptsm@linux.microsoft.com> Content-Language: en-US From: Prasanna Kumar T S M In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On 18-03-2026 21:36, Michal Simek wrote: > > > On 3/17/26 15:36, Prasanna Kumar T S M wrote: >> [Some people who received this message don't often get email from >> ptsm@linux.microsoft.com. Learn why this is important at https:// >> aka.ms/LearnAboutSenderIdentification ] >> >> A mbox rx channel is requested using mbox_request_channel_byname() in >> probe. In remove callback, the rx mailbox channel is cleaned up when the >> rx_chan is NULL due to incorrect condition check. The mailbox channel is >> not shutdown and it can receive messages even after the device removal. >> This leads to use after free. Also the channel resources are not freed. >> Fix this by checking the rx_chan correctly. >> >> Fixes: ffdbae28d9d1 ("drivers: soc: xilinx: Use mailbox IPI callback") >> Signed-off-by: Prasanna Kumar T S M >> --- >>   drivers/soc/xilinx/zynqmp_power.c | 2 +- >>   1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/soc/xilinx/zynqmp_power.c b/drivers/soc/xilinx/ >> zynqmp_power.c >> index aa35b63b45a3..5086c1e6797e 100644 >> --- a/drivers/soc/xilinx/zynqmp_power.c >> +++ b/drivers/soc/xilinx/zynqmp_power.c >> @@ -398,7 +398,7 @@ static void zynqmp_pm_remove(struct >> platform_device *pdev) >>   { >>          sysfs_remove_file(&pdev->dev.kobj, &dev_attr_suspend_mode.attr); >> >> -       if (!rx_chan) >> +       if (rx_chan) >>                  mbox_free_channel(rx_chan); > > > Please also clear that global variable because when the driver is re- > bound there will be old reference to rx_chan which shouldn't be there. > >          if (rx_chan) { >                  mbox_free_channel(rx_chan); >                  rx_chan = NULL; >          } > > And please send both patches as one thread. > > Thanks, > Michal Hi Michal, Thanks for the review. Sent v2. Thanks, Prasanna