From: Dave Jiang <dave.jiang@intel.com>
To: Vinicius Costa Gomes <vinicius.gomes@intel.com>,
Vinod Koul <vkoul@kernel.org>, Frank Li <Frank.Li@kernel.org>,
Fenghua Yu <fenghuay@nvidia.com>,
Shuai Xue <xueshuai@linux.alibaba.com>
Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 3/6] dmaengine: idxd: Fix potential double free on probe error path
Date: Tue, 13 Oct 2026 10:30:27 -0700 [thread overview]
Message-ID: <c58db0c6-3484-436e-892a-a818785996f6@intel.com> (raw)
In-Reply-To: <20261012-wt-idxd-fixes-v1-3-30a35a445077@intel.com>
On 10/12/26 2:38 PM, Vinicius Costa Gomes wrote:
> On the probe error path the device is released via put_device() ->
> idxd_conf_device_release(), which frees idxd->wq and the idxd->wqs,
> idxd->engines, idxd->groups and idxd->wq_enable_map arrays. The
> idxd_clean_*() helpers and the idxd_setup_*() error unwind paths free
> the same objects, so they get freed twice.
>
> With commit ec2d428b2e32 ("dmaengine: idxd: fix double free of wq,
> engine, and group structs") we made use of the kobject lifetime to
> keep track of device memory allocations. These deallocations were left
> behind. Remove them as idxd_conf_device_release() is already taking
> care of that.
>
> Fixes: 3d33de353b1f ("dmaengine: idxd: Fix not releasing workqueue on .release()")
> Link: https://lore.kernel.org/all/20260615103932.61828-1-bogdan.codres@windriver.com/
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> ---
> drivers/dma/idxd/init.c | 11 -----------
> 1 file changed, 11 deletions(-)
>
> diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
> index 4adb3f3bcd01..8cf478c5b26d 100644
> --- a/drivers/dma/idxd/init.c
> +++ b/drivers/dma/idxd/init.c
> @@ -166,8 +166,6 @@ static void idxd_clean_wqs(struct idxd_device *idxd)
> conf_dev = wq_confdev(idxd->wqs[i]);
> put_device(conf_dev);
> }
> - bitmap_free(idxd->wq_enable_map);
> - kfree(idxd->wqs);
> }
>
> static int idxd_setup_wqs(struct idxd_device *idxd)
> @@ -245,11 +243,8 @@ static int idxd_setup_wqs(struct idxd_device *idxd)
> conf_dev = wq_confdev(idxd->wqs[i]);
> put_device(conf_dev);
> }
> - bitmap_free(idxd->wq_enable_map);
>
> err_free_wqs:
> - kfree(idxd->wqs);
> -
> return rc;
> }
>
> @@ -262,7 +257,6 @@ static void idxd_clean_engines(struct idxd_device *idxd)
> conf_dev = engine_confdev(idxd->engines[i]);
> put_device(conf_dev);
> }
> - kfree(idxd->engines);
> }
>
> static int idxd_setup_engines(struct idxd_device *idxd)
> @@ -308,7 +302,6 @@ static int idxd_setup_engines(struct idxd_device *idxd)
> conf_dev = engine_confdev(idxd->engines[i]);
> put_device(conf_dev);
> }
> - kfree(idxd->engines);
>
> return rc;
> }
> @@ -320,7 +313,6 @@ static void idxd_clean_groups(struct idxd_device *idxd)
> for (i = 0; i < idxd->max_groups; i++) {
> put_device(group_confdev(idxd->groups[i]));
> }
> - kfree(idxd->groups);
> }
>
> static int idxd_setup_groups(struct idxd_device *idxd)
> @@ -378,7 +370,6 @@ static int idxd_setup_groups(struct idxd_device *idxd)
> group = idxd->groups[i];
> put_device(group_confdev(group));
> }
> - kfree(idxd->groups);
>
> return rc;
> }
> @@ -388,7 +379,6 @@ static void idxd_cleanup_internals(struct idxd_device *idxd)
> idxd_clean_groups(idxd);
> idxd_clean_engines(idxd);
> idxd_clean_wqs(idxd);
> - destroy_workqueue(idxd->wq);
> }
>
> static int idxd_init_evl(struct idxd_device *idxd)
> @@ -459,7 +449,6 @@ static int idxd_setup_internals(struct idxd_device *idxd)
> return 0;
>
> err_evl:
> - destroy_workqueue(idxd->wq);
> err_wkq_create:
> idxd_clean_groups(idxd);
> err_group:
>
next prev parent reply other threads:[~2026-10-13 17:30 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-12 21:38 [PATCH 0/6] dmaengine: idxd: More error handling fixes Vinicius Costa Gomes
2026-10-12 21:38 ` [PATCH 1/6] dmaengine: idxd: Do not call destroy_workqueue with null idxd->wq Vinicius Costa Gomes
2026-10-13 14:55 ` Frank Li
2026-10-13 17:18 ` Dave Jiang
2026-10-13 22:34 ` Vinicius Costa Gomes
2026-10-12 21:38 ` [PATCH 2/6] dmaengine: idxd: fix duplicate memory frees on initialization error path Vinicius Costa Gomes
2026-10-13 14:57 ` Frank Li
2026-10-13 22:31 ` Vinicius Costa Gomes
2026-10-13 17:21 ` Dave Jiang
2026-10-12 21:38 ` [PATCH 3/6] dmaengine: idxd: Fix potential double free on probe " Vinicius Costa Gomes
2026-10-13 17:30 ` Dave Jiang [this message]
2026-10-12 21:38 ` [PATCH 4/6] dmaengine: idxd: Fix unwind bounds in device registration error paths Vinicius Costa Gomes
2026-10-12 21:38 ` [PATCH 5/6] dmaengine: idxd: Fix error code handling in idxd_cdev_open() Vinicius Costa Gomes
2026-10-12 21:38 ` [PATCH 6/6] dmaengine: idxd: Do not release interrupt handles on terminate_all Vinicius Costa Gomes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c58db0c6-3484-436e-892a-a818785996f6@intel.com \
--to=dave.jiang@intel.com \
--cc=Frank.Li@kernel.org \
--cc=dmaengine@vger.kernel.org \
--cc=fenghuay@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=vinicius.gomes@intel.com \
--cc=vkoul@kernel.org \
--cc=xueshuai@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®