[PATCH 2/2] soc: xilinx: Shutdown and free rx mailbox channel

[Prasanna Kumar T S M]

On 18-03-2026 21:36, Michal Simek wrote:
> 
> 
> On 3/17/26 15:36, Prasanna Kumar T S M wrote:
>> [Some people who received this message don't often get email from 
>> ptsm at linux.microsoft.com. Learn why this is important at https:// 
>> aka.ms/LearnAboutSenderIdentification ]
>>
>> A mbox rx channel is requested using mbox_request_channel_byname() in
>> probe. In remove callback, the rx mailbox channel is cleaned up when the
>> rx_chan is NULL due to incorrect condition check. The mailbox channel is
>> not shutdown and it can receive messages even after the device removal.
>> This leads to use after free. Also the channel resources are not freed.
>> Fix this by checking the rx_chan correctly.
>>
>> Fixes: ffdbae28d9d1 ("drivers: soc: xilinx: Use mailbox IPI callback")
>> Signed-off-by: Prasanna Kumar T S M <ptsm at linux.microsoft.com>
>> ---
>>   drivers/soc/xilinx/zynqmp_power.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/soc/xilinx/zynqmp_power.c b/drivers/soc/xilinx/ 
>> zynqmp_power.c
>> index aa35b63b45a3..5086c1e6797e 100644
>> --- a/drivers/soc/xilinx/zynqmp_power.c
>> +++ b/drivers/soc/xilinx/zynqmp_power.c
>> @@ -398,7 +398,7 @@ static void zynqmp_pm_remove(struct 
>> platform_device *pdev)
>>   {
>>          sysfs_remove_file(&pdev->dev.kobj, &dev_attr_suspend_mode.attr);
>>
>> -       if (!rx_chan)
>> +       if (rx_chan)
>>                  mbox_free_channel(rx_chan);
> 
> 
> Please also clear that global variable because when the driver is re- 
> bound there will be old reference to rx_chan which shouldn't be there.
> 
>           if (rx_chan) {
>                   mbox_free_channel(rx_chan);
>                   rx_chan = NULL;
>           }
> 
> And please send both patches as one thread.
> 
> Thanks,
> Michal

Hi Michal,

Thanks for the review. Sent v2.

Thanks,
Prasanna