In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix potential NULL pointer dereference in context cleanup

aiedestroycontext() is invoked during error handling in aie2createcontext(). However, aiedestroycontext() assumes that the context's mailbox channel pointer is non-NULL. If mailbox channel creation fails, the pointer remains NULL and calling aiedestroycontext() can lead to a NULL pointer dereference.

In aie2createcontext(), replace aiedestroycontext() with a function which request firmware to remove the context created previously.

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix crash when destroying a suspended hardware context

If userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, the driver may crash because the mailbox channel pointer is NULL for the suspended context.

Fix this by checking the mailbox channel pointer in aie2destroycontext() before accessing it.