]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
authorYuho Choi <dbgh9129@gmail.com>
Mon, 25 May 2026 14:15:50 +0000 (10:15 -0400)
committerVinod Koul <vkoul@kernel.org>
Thu, 2 Jul 2026 15:19:54 +0000 (20:49 +0530)
commitee1d7274102285d78a53161fc705a8d8cd40b066
treec27db91076c71c6f7b112bb4a4793369779e591f
parentec2d428b2e32dd157de8f86a86dd85c5b2c8f45c
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()

The failed_dev_add and failed_dev_name paths drop the file-device
reference while wq->wq_lock is still held. If put_device(fdev) drops the
last reference, idxd_file_dev_release() runs synchronously and tries to
take wq->wq_lock again, deadlocking.

Those paths also fall through into the later ctx cleanup labels even
though idxd_file_dev_release() owns that cleanup and frees ctx. This can
make idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.

Move idxd_wq_get() before file-device setup can fail, since the release
callback always calls idxd_wq_put(). Then unlock wq->wq_lock before
put_device(fdev) and return directly from the file-device setup failure
path, leaving ctx cleanup to the release callback.

Fixes: e6fd6d7e5f0fe ("dmaengine: idxd: add a device to represent the file opened")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://patch.msgid.link/20260525141550.1385581-1-dbgh9129@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
drivers/dma/idxd/cdev.c