Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
accel/amdxdna: Fix crash when destroying a suspended hardware context
If userspace issues an ioctl to destroy a hardware context that has
already been automatically suspended, the driver may crash because the
mailbox channel pointer is NULL for the suspended context.
Fix this by checking the mailbox channel pointer in aie2_destroy_context()
before accessing it.
Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup")
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260206060306.4050531-1-lizhi.hou@amd.com
+3
+3
drivers/accel/amdxdna/aie2_message.c
+3
drivers/accel/amdxdna/aie2_message.c
···
318
318
struct amdxdna_dev *xdna = ndev->xdna;
319
319
int ret;
320
320
321
+
if (!hwctx->priv->mbox_chann)
322
+
return 0;
323
+
321
324
xdna_mailbox_stop_channel(hwctx->priv->mbox_chann);
322
325
ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
323
326
xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann);