linux-kernel - Re: [PATCH V1] accel/amdxdna: Fix crash when destroying a suspended hardware context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <66a231b3-3335-4e65-b38f-ff1fa9ec8f2b@linux.intel.com>
Date: Fri, 6 Feb 2026 07:52:40 +0100
From: Karol Wachowski <karol.wachowski@...ux.intel.com>
To: Lizhi Hou <lizhi.hou@....com>, ogabbay@...nel.org,
 quic_jhugo@...cinc.com, dri-devel@...ts.freedesktop.org,
 maciej.falkowski@...ux.intel.com
Cc: linux-kernel@...r.kernel.org, max.zhen@....com, sonal.santan@....com,
 mario.limonciello@....com
Subject: Re: [PATCH V1] accel/amdxdna: Fix crash when destroying a suspended
 hardware context

On 2/6/2026 7:03 AM, Lizhi Hou wrote:
> If userspace issues an ioctl to destroy a hardware context that has
> already been automatically suspended, the driver may crash because the
> mailbox channel pointer is NULL for the suspended context.
> 
> Fix this by checking the mailbox channel pointer in aie2_destroy_context()
> before accessing it.
> 
> Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup")
> Signed-off-by: Lizhi Hou <lizhi.hou@....com>
> ---
>  drivers/accel/amdxdna/aie2_message.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c
> index 7d7dcfeaf794..ab1178850c47 100644
> --- a/drivers/accel/amdxdna/aie2_message.c
> +++ b/drivers/accel/amdxdna/aie2_message.c
> @@ -318,6 +318,9 @@ int aie2_destroy_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwc
>  	struct amdxdna_dev *xdna = ndev->xdna;
>  	int ret;
>  
> +	if (!hwctx->priv->mbox_chann)
> +		return 0;
> +
>  	xdna_mailbox_stop_channel(hwctx->priv->mbox_chann);
>  	ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
>  	xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann);
Reviewed-by: Karol Wachowski <karol.wachowski@...ux.intel.com>