Re: [PATCH 2/2] soc: xilinx: Shutdown and free rx mailbox channel

[Prasanna Kumar T S M]

On 18-03-2026 21:36, Michal Simek wrote:
> On 3/17/26 15:36, Prasanna Kumar T S M wrote:
> > [Some people who received this message don't often get email from 
> > ptsm@xxxxxxxxxxxxxxxxxxx. Learn why this is important at https:// 
> > aka.ms/LearnAboutSenderIdentification ]
> >
> > A mbox rx channel is requested using mbox_request_channel_byname() in
> > probe. In remove callback, the rx mailbox channel is cleaned up when the
> > rx_chan is NULL due to incorrect condition check. The mailbox channel is
> > not shutdown and it can receive messages even after the device removal.
> > This leads to use after free. Also the channel resources are not freed.
> > Fix this by checking the rx_chan correctly.
> >
> > Fixes: ffdbae28d9d1 ("drivers: soc: xilinx: Use mailbox IPI callback")
> > Signed-off-by: Prasanna Kumar T S M <ptsm@xxxxxxxxxxxxxxxxxxx>
> > ---
> >   drivers/soc/xilinx/zynqmp_power.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/soc/xilinx/zynqmp_power.c b/drivers/soc/xilinx/ 
> > zynqmp_power.c
> > index aa35b63b45a3..5086c1e6797e 100644
> > --- a/drivers/soc/xilinx/zynqmp_power.c
> > +++ b/drivers/soc/xilinx/zynqmp_power.c
> > @@ -398,7 +398,7 @@ static void zynqmp_pm_remove(struct 
> > platform_device *pdev)
> >   {
> >          sysfs_remove_file(&pdev->dev.kobj, &dev_attr_suspend_mode.attr);
> >
> > -       if (!rx_chan)
> > +       if (rx_chan)
> >                  mbox_free_channel(rx_chan);
>
>
> Please also clear that global variable because when the driver is re- 
> bound there will be old reference to rx_chan which shouldn't be there.
>
>           if (rx_chan) {
>                   mbox_free_channel(rx_chan);
>                   rx_chan = NULL;
>           }
>
> And please send both patches as one thread.
>
> Thanks,
> Michal

Hi Michal,

Thanks for the review. Sent v2.

Thanks,
Prasanna