Re: [PATCH] mailbox: make the channel receive function robust

[Jassi Brar]

On Sat, May 9, 2026 at 8:24 AM Zhiqiang Hou <Zhiqiang.Hou@xxxxxxx> wrote:
>
> From: Hou Zhiqiang <Zhiqiang.Hou@xxxxxxx>
>
> Mailbox may receive fake messages on a channel without binding
> to a client, this can result in kernel crash.
>
> Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@xxxxxxx>
> ---
>  drivers/mailbox/mailbox.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
> index bbc9fd75a95f7..1febfac5a85dd 100644
> --- a/drivers/mailbox/mailbox.c
> +++ b/drivers/mailbox/mailbox.c
> @@ -145,7 +145,7 @@ static enum hrtimer_restart txdone_hrtimer(struct hrtimer *hrtimer)
>  void mbox_chan_received_data(struct mbox_chan *chan, void *mssg)
>  {
>         /* No buffering the received data */
> -       if (chan->cl->rx_callback)
> +       if (chan->cl && chan->cl->rx_callback)
>                 chan->cl->rx_callback(chan->cl, mssg);
>  }
>
This is a chance to fix the controller driver, it should not be
pushing RX before the channel is enabled (startup called).
A channel will be enabled only when a client requests the channel. So
chan->cl is never expected to be NULL here

Cheers,
Jassi