Re: [PATCH 2/2] soc: xilinx: Shutdown and free rx mailbox channel

[Michal Simek <michal.simek@amd.com>]

On 3/17/26 15:36, Prasanna Kumar T S M wrote:
> [Some people who received this message don't often get email from ptsm@linux.microsoft.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> A mbox rx channel is requested using mbox_request_channel_byname() in
> probe. In remove callback, the rx mailbox channel is cleaned up when the
> rx_chan is NULL due to incorrect condition check. The mailbox channel is
> not shutdown and it can receive messages even after the device removal.
> This leads to use after free. Also the channel resources are not freed.
> Fix this by checking the rx_chan correctly.
> 
> Fixes: ffdbae28d9d1 ("drivers: soc: xilinx: Use mailbox IPI callback")
> Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
> ---
>   drivers/soc/xilinx/zynqmp_power.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/soc/xilinx/zynqmp_power.c b/drivers/soc/xilinx/zynqmp_power.c
> index aa35b63b45a3..5086c1e6797e 100644
> --- a/drivers/soc/xilinx/zynqmp_power.c
> +++ b/drivers/soc/xilinx/zynqmp_power.c
> @@ -398,7 +398,7 @@ static void zynqmp_pm_remove(struct platform_device *pdev)
>   {
>          sysfs_remove_file(&pdev->dev.kobj, &dev_attr_suspend_mode.attr);
> 
> -       if (!rx_chan)
> +       if (rx_chan)
>                  mbox_free_channel(rx_chan);


Please also clear that global variable because when the driver is re-bound there 
will be old reference to rx_chan which shouldn't be there.

          if (rx_chan) {
                  mbox_free_channel(rx_chan);
                  rx_chan = NULL;
          }

And please send both patches as one thread.

Thanks,
Michal