[PATCH 2/5] lib: utils/mailbox: Unlink mailbox channel before freeing it

[Nick Hu]

Both mbox_controller_free_chan() and mbox_controller_remove() call the
controller's free_chan() callback before removing the channel from the
controller's channel list. The callback may free the memory backing the
channel (e.g. rpmi_shmem_mbox_free_chan() frees the enclosing
struct rpmi_srvgrp_chan), so the following sbi_list_del() then writes
to freed memory through chan->node.

Remove the channel from the list first and only then call free_chan().

Fixes: ad846a7cb8cd ("lib: utils/mailbox: Add generic mailbox library")
Signed-off-by: Nick Hu <nick.hu at sifive.com>
---
 lib/utils/mailbox/mailbox.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/utils/mailbox/mailbox.c b/lib/utils/mailbox/mailbox.c
index b3f7e8b9..a617cc5d 100644
--- a/lib/utils/mailbox/mailbox.c
+++ b/lib/utils/mailbox/mailbox.c
@@ -51,9 +51,9 @@ void mbox_controller_remove(struct mbox_controller *mbox)
 	while (!sbi_list_empty(&mbox->chan_list)) {
 		chan = sbi_list_first_entry(&mbox->chan_list,
 					    struct mbox_chan, node);
+		sbi_list_del(&chan->node);
 		if (mbox->free_chan)
 			mbox->free_chan(mbox, chan);
-		sbi_list_del(&chan->node);
 	}
 
 	sbi_list_del(&mbox->node);
@@ -90,9 +90,9 @@ void mbox_controller_free_chan(struct mbox_chan *chan)
 	if (!chan || !chan->mbox)
 		return;
 
+	sbi_list_del(&chan->node);
 	if (chan->mbox->free_chan)
 		chan->mbox->free_chan(chan->mbox, chan);
-	sbi_list_del(&chan->node);
 }
 
 int mbox_chan_xfer(struct mbox_chan *chan, struct mbox_xfer *xfer)

-- 
2.43.7