tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

dmaengine: idxd: Fix freeing the allocated ida too late

It can happen that when the cdev .release() is called, the driver
already called ida_destroy(). Move ida_free() to the _del() path.

We see with DEBUG_KOBJECT_RELEASE enabled and forcing an early PCI
unbind.

Fixes: 04922b7445a1 ("dmaengine: idxd: fix cdev setup and free device lifetime issues")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-9-7ed70658a9d1@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

authored by

Vinicius Costa Gomes and committed by
Vinod Koul c311f5e9 d9cfb519

+4 -4
+4 -4
drivers/dma/idxd/cdev.c
··· 158 158 static void idxd_cdev_dev_release(struct device *dev) 159 159 { 160 160 struct idxd_cdev *idxd_cdev = dev_to_cdev(dev); 161 - struct idxd_cdev_context *cdev_ctx; 162 - struct idxd_wq *wq = idxd_cdev->wq; 163 161 164 - cdev_ctx = &ictx[wq->idxd->data->type]; 165 - ida_free(&cdev_ctx->minor_ida, idxd_cdev->minor); 166 162 kfree(idxd_cdev); 167 163 } 168 164 ··· 578 582 579 583 void idxd_wq_del_cdev(struct idxd_wq *wq) 580 584 { 585 + struct idxd_cdev_context *cdev_ctx; 581 586 struct idxd_cdev *idxd_cdev; 582 587 583 588 idxd_cdev = wq->idxd_cdev; 584 589 wq->idxd_cdev = NULL; 585 590 cdev_device_del(&idxd_cdev->cdev, cdev_dev(idxd_cdev)); 591 + 592 + cdev_ctx = &ictx[wq->idxd->data->type]; 593 + ida_free(&cdev_ctx->minor_ida, idxd_cdev->minor); 586 594 put_device(cdev_dev(idxd_cdev)); 587 595 } 588 596