aie2_create_context() stores the allocated mailbox channel in
hwctx->priv->mbox_chann before starting the channel. If
xdna_mailbox_start_channel() fails, the error path frees the channel but
leaves the saved pointer intact.
A later context cleanup only checks whether hwctx->priv->mbox_chann is
NULL before stopping and freeing it. Leaving the freed channel pointer
there can therefore make cleanup operate on stale memory.
Clear hwctx->priv->mbox_chann after freeing the channel on the create
failure path so later cleanup sees that no mailbox channel is owned.
A static analysis checker reported the stale ownership state, and manual
source review confirmed the error path.
Fixes: d5b8b0347fa8 ("accel/amdxdna: Split mailbox channel create function")
Signed-off-by: Ruoyu Wang <[email protected]>
---
drivers/accel/amdxdna/aie2_message.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/accel/amdxdna/aie2_message.c
b/drivers/accel/amdxdna/aie2_message.c
index c4b364801cc04..a22d025794598 100644
--- a/drivers/accel/amdxdna/aie2_message.c
+++ b/drivers/accel/amdxdna/aie2_message.c
@@ -277,6 +277,7 @@ int aie2_create_context(struct amdxdna_dev_hdl *ndev,
struct amdxdna_hwctx *hwct
free_channel:
xdna_mailbox_free_channel(hwctx->priv->mbox_chann);
+ hwctx->priv->mbox_chann = NULL;
del_ctx_req:
aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
return ret;
--
2.51.0
