Re: [PATCH] mailbox: pcc: Free the channel before unmapping the shared memory

[Adam Young]

On 8/17/26 05:42, Breno Leitao wrote:
> Hello Adam,
>
> On Sat, Aug 15, 2026 at 11:58:16PM -0400, Adam Young wrote:
> > On 8/12/26 08:36, Breno Leitao wrote:
> > > Free the channel first, before the memory unmap. mbox_free_channel()
> > > calls pcc_shutdown(), which frees the platform interrupt, and then unmap
> > > shared memory.
> > I posted a related fix undere the MCTP PCC Driver changes.
> >
> > This fix is necessary but not sufficient to deal with the race conditions.
> > Take a look at the series of patches under here:
> >
> > https://lore.kernel.org/all/20260721175258.87600-1-admiyo@xxxxxxxxxxxxxxxxxxxxxx/
> That looks like a much bigger series, with new features, open discussions,
> Nacks, and already 45 revisions.
>
> This curent fix is only meant to address a real problem (user after
> free) I am hitting in production systems.
>
> My suggestion is that we get this real issue unblocked, even if not
> complete, while you keep working on your larger series.
>
> Thanks,
> --breno

There are two patches that address this issue from that series:

This one is, I believe, a superset of the fix you put in.

https://lore.kernel.org/all/20260721175258.87600-2-admiyo@xxxxxxxxxxxxxxxxxxxxxx/

Note that the unmap is moved to the mailbox teardown function, which 
happens immediately after the IRQ unregister.  Those two operatations 
need to happen atomically to avoid the issue you saw. Thus, I think your 
patch is insufficient to actually deal with the race condition:  it 
needs to happen in pcc_shutdown.