Mailbox message IDs are allocated cyclically. When destroying a mailbox
channel, pending messages are canceled starting from message ID 0. This
results in an incorrect cancellation order when the ID of the last posted
message wraps around and is smaller than the ID of the first posted
message.

Fix this by canceling pending messages starting from the next available
message ID, ensuring the correct ordering across wraparound.

Fixes: a37d78470bcc ("accel/amdxdna: Replace idr api with xarray")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
 drivers/accel/amdxdna/amdxdna_mailbox.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
index 84a7e92562ad..336e5e77f18a 100644
--- a/drivers/accel/amdxdna/amdxdna_mailbox.c
+++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
@@ -549,7 +549,9 @@ void xdna_mailbox_stop_channel(struct mailbox_channel *mb_chann)
 	drain_workqueue(mb_chann->work_q);
 
 	/* We can clean up and release resources */
-	xa_for_each(&mb_chann->chan_xa, msg_id, mb_msg)
+	xa_for_each_start(&mb_chann->chan_xa, msg_id, mb_msg, mb_chann->next_msgid)
+		mailbox_release_msg(mb_chann, mb_msg);
+	xa_for_each_range(&mb_chann->chan_xa, msg_id, mb_msg, 0, mb_chann->next_msgid - 1)
 		mailbox_release_msg(mb_chann, mb_msg);
 	xa_destroy(&mb_chann->chan_xa);
 
-- 
2.34.1

On 4/13/26 13:18, Lizhi Hou wrote:
> Mailbox message IDs are allocated cyclically. When destroying a mailbox
> channel, pending messages are canceled starting from message ID 0. This
> results in an incorrect cancellation order when the ID of the last posted
> message wraps around and is smaller than the ID of the first posted
> message.
> 
> Fix this by canceling pending messages starting from the next available
> message ID, ensuring the correct ordering across wraparound.
> 
> Fixes: a37d78470bcc ("accel/amdxdna: Replace idr api with xarray")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
> ---
>   drivers/accel/amdxdna/amdxdna_mailbox.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
> index 84a7e92562ad..336e5e77f18a 100644
> --- a/drivers/accel/amdxdna/amdxdna_mailbox.c
> +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
> @@ -549,7 +549,9 @@ void xdna_mailbox_stop_channel(struct mailbox_channel *mb_chann)
>   	drain_workqueue(mb_chann->work_q);
>   
>   	/* We can clean up and release resources */
> -	xa_for_each(&mb_chann->chan_xa, msg_id, mb_msg)
> +	xa_for_each_start(&mb_chann->chan_xa, msg_id, mb_msg, mb_chann->next_msgid)
> +		mailbox_release_msg(mb_chann, mb_msg);
> +	xa_for_each_range(&mb_chann->chan_xa, msg_id, mb_msg, 0, mb_chann->next_msgid - 1)
>   		mailbox_release_msg(mb_chann, mb_msg);
>   	xa_destroy(&mb_chann->chan_xa);
>

Applied to drm-misc-next

On 4/13/26 15:40, Mario Limonciello wrote:
>
>
> On 4/13/26 13:18, Lizhi Hou wrote:
>> Mailbox message IDs are allocated cyclically. When destroying a mailbox
>> channel, pending messages are canceled starting from message ID 0. This
>> results in an incorrect cancellation order when the ID of the last 
>> posted
>> message wraps around and is smaller than the ID of the first posted
>> message.
>>
>> Fix this by canceling pending messages starting from the next available
>> message ID, ensuring the correct ordering across wraparound.
>>
>> Fixes: a37d78470bcc ("accel/amdxdna: Replace idr api with xarray")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
>> ---
>>   drivers/accel/amdxdna/amdxdna_mailbox.c | 4 +++-
>>   1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c 
>> b/drivers/accel/amdxdna/amdxdna_mailbox.c
>> index 84a7e92562ad..336e5e77f18a 100644
>> --- a/drivers/accel/amdxdna/amdxdna_mailbox.c
>> +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
>> @@ -549,7 +549,9 @@ void xdna_mailbox_stop_channel(struct 
>> mailbox_channel *mb_chann)
>>       drain_workqueue(mb_chann->work_q);
>>         /* We can clean up and release resources */
>> -    xa_for_each(&mb_chann->chan_xa, msg_id, mb_msg)
>> +    xa_for_each_start(&mb_chann->chan_xa, msg_id, mb_msg, 
>> mb_chann->next_msgid)
>> +        mailbox_release_msg(mb_chann, mb_msg);
>> +    xa_for_each_range(&mb_chann->chan_xa, msg_id, mb_msg, 0, 
>> mb_chann->next_msgid - 1)
>>           mailbox_release_msg(mb_chann, mb_msg);
>>       xa_destroy(&mb_chann->chan_xa);
>