[PATCH 1/2] accel/amdxdna: Fix NULL pointer dereference in mailbox channel cleanup

[Mario Limonciello <mario.limonciello@amd.com>]

aie2_destroy_context() is called during various cleanup paths, including
when context creation fails partially. If xdna_mailbox_create_channel()
fails during aie2_create_context(), the hwctx->priv->mbox_chann pointer
remains NULL. When cleanup occurs (e.g., during process termination via
amdxdna_hwctx_remove_all), aie2_destroy_context() is invoked and attempts
to stop and destroy the NULL mailbox channel, leading to a NULL pointer
dereference.

The issue was observed in the following call path:
  amdxdna_drm_close
    amdxdna_hwctx_remove_all
      aie2_hwctx_fini
        aie2_release_resource
          aie2_destroy_context
            xdna_mailbox_stop_channel <- NULL dereference

Add NULL checks in aie2_destroy_context() before calling mailbox channel
operations. Also add defensive NULL checks in aie2_hw_stop() for both
mgmt_chann and mbox to prevent similar issues during device shutdown.

Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
---
 drivers/accel/amdxdna/aie2_message.c | 14 +++++++++-----
 drivers/accel/amdxdna/aie2_pci.c     | 14 +++++++++-----
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/drivers/accel/amdxdna/aie2_message.c b/drivers/accel/amdxdna/aie2_message.c
index 7d7dcfeaf7942..77e3cdf18658b 100644
--- a/drivers/accel/amdxdna/aie2_message.c
+++ b/drivers/accel/amdxdna/aie2_message.c
@@ -318,11 +318,15 @@ int aie2_destroy_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwc
 	struct amdxdna_dev *xdna = ndev->xdna;
 	int ret;
 
-	xdna_mailbox_stop_channel(hwctx->priv->mbox_chann);
-	ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
-	xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann);
-	XDNA_DBG(xdna, "Destroyed fw ctx %d", hwctx->fw_ctx_id);
-	hwctx->priv->mbox_chann = NULL;
+	if (hwctx->priv->mbox_chann) {
+		xdna_mailbox_stop_channel(hwctx->priv->mbox_chann);
+		ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
+		xdna_mailbox_destroy_channel(hwctx->priv->mbox_chann);
+		XDNA_DBG(xdna, "Destroyed fw ctx %d", hwctx->fw_ctx_id);
+		hwctx->priv->mbox_chann = NULL;
+	} else {
+		ret = aie2_destroy_context_req(ndev, hwctx->fw_ctx_id);
+	}
 	hwctx->fw_ctx_id = -1;
 	ndev->hwctx_num--;
 
diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
index f70ccf0f3c019..9c2572706bf53 100644
--- a/drivers/accel/amdxdna/aie2_pci.c
+++ b/drivers/accel/amdxdna/aie2_pci.c
@@ -324,11 +324,15 @@ static void aie2_hw_stop(struct amdxdna_dev *xdna)
 	}
 
 	aie2_mgmt_fw_fini(ndev);
-	xdna_mailbox_stop_channel(ndev->mgmt_chann);
-	xdna_mailbox_destroy_channel(ndev->mgmt_chann);
-	ndev->mgmt_chann = NULL;
-	drmm_kfree(&xdna->ddev, ndev->mbox);
-	ndev->mbox = NULL;
+	if (ndev->mgmt_chann) {
+		xdna_mailbox_stop_channel(ndev->mgmt_chann);
+		xdna_mailbox_destroy_channel(ndev->mgmt_chann);
+		ndev->mgmt_chann = NULL;
+	}
+	if (ndev->mbox) {
+		drmm_kfree(&xdna->ddev, ndev->mbox);
+		ndev->mbox = NULL;
+	}
 	aie2_psp_stop(ndev->psp_hdl);
 	aie2_smu_fini(ndev);
 	aie2_error_async_events_free(ndev);
-- 
2.53.0