dmaengine: idxd: Fix freeing the allocated ida too late

[ Upstream commit c311f5e9248471a950f0a524c2fd736414d98900 ]

It can happen that when the cdev .release() is called, the driver
already called ida_destroy(). Move ida_free() to the _del() path.

We see with DEBUG_KOBJECT_RELEASE enabled and forcing an early PCI
unbind.

Fixes: 04922b7445a1 ("dmaengine: idxd: fix cdev setup and free device lifetime issues")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-9-7ed70658a9d1@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
index 7e4715f927732702416d917f34ab0a83f575d533..4105688cf3f060704b851ee17467c135c170326e 100644 (file)
--- a/drivers/dma/idxd/cdev.c
+++ b/drivers/dma/idxd/cdev.c
@@ -158,11 +158,7 @@ static const struct device_type idxd_cdev_file_type = {
 static void idxd_cdev_dev_release(struct device *dev)
 {
        struct idxd_cdev *idxd_cdev = dev_to_cdev(dev);
-       struct idxd_cdev_context *cdev_ctx;
-       struct idxd_wq *wq = idxd_cdev->wq;
 
-       cdev_ctx = &ictx[wq->idxd->data->type];
-       ida_free(&cdev_ctx->minor_ida, idxd_cdev->minor);
        kfree(idxd_cdev);
 }
 
@@ -582,11 +578,15 @@ int idxd_wq_add_cdev(struct idxd_wq *wq)
 
 void idxd_wq_del_cdev(struct idxd_wq *wq)
 {
+       struct idxd_cdev_context *cdev_ctx;
        struct idxd_cdev *idxd_cdev;
 
        idxd_cdev = wq->idxd_cdev;
        wq->idxd_cdev = NULL;
        cdev_device_del(&idxd_cdev->cdev, cdev_dev(idxd_cdev));
+
+       cdev_ctx = &ictx[wq->idxd->data->type];
+       ida_free(&cdev_ctx->minor_ida, idxd_cdev->minor);
        put_device(cdev_dev(idxd_cdev));
 }