[PATCH] dmaengine: idxd: Avoid destroying the device workqueue twice

[PATCH] dmaengine: idxd: Avoid destroying the device workqueue twice

[Yao Kai]

If idxd_probe() fails after idxd_setup_internals() succeeds,
idxd_cleanup_internals() destroys idxd->wq. The PCI probe error path
then calls idxd_free(), whose put_device() invokes
idxd_conf_device_release() and destroys the same workqueue again.
The err_evl path in idxd_setup_internals() has the same problem.
This can corrupt the workqueue list or access freed memory.

Clear idxd->wq after both error-path destroy_workqueue() calls and
only destroy a non-NULL workqueue in the release callback. The NULL
check also handles failures before the workqueue is created, while
preserving its destruction on normal device removal.

Fixes: 3d33de353b1f ("dmaengine: idxd: Fix not releasing workqueue on .release()")
Cc: stable@vger.kernel.org
Signed-off-by: Yao Kai <yaokai34@huawei.com>
---
 drivers/dma/idxd/init.c  | 2 ++
 drivers/dma/idxd/sysfs.c | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
index 4b827a329756..ffbc5a74be6e 100644
--- a/drivers/dma/idxd/init.c
+++ b/drivers/dma/idxd/init.c
@@ -389,6 +389,7 @@ static void idxd_cleanup_internals(struct idxd_device *idxd)
 	idxd_clean_engines(idxd);
 	idxd_clean_wqs(idxd);
 	destroy_workqueue(idxd->wq);
+	idxd->wq = NULL;
 }
 
 static int idxd_init_evl(struct idxd_device *idxd)
@@ -460,6 +461,7 @@ static int idxd_setup_internals(struct idxd_device *idxd)
 
  err_evl:
 	destroy_workqueue(idxd->wq);
+	idxd->wq = NULL;
  err_wkq_create:
 	idxd_clean_groups(idxd);
  err_group:
diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
index 6d251095c350..d5ffc641c856 100644
--- a/drivers/dma/idxd/sysfs.c
+++ b/drivers/dma/idxd/sysfs.c
@@ -1836,7 +1836,8 @@ static void idxd_conf_device_release(struct device *dev)
 {
 	struct idxd_device *idxd = confdev_to_idxd(dev);
 
-	destroy_workqueue(idxd->wq);
+	if (idxd->wq)
+		destroy_workqueue(idxd->wq);
 	kfree(idxd->groups);
 	bitmap_free(idxd->wq_enable_map);
 	kfree(idxd->wqs);
-- 
2.43.0

Re: [PATCH] dmaengine: idxd: Avoid destroying the device workqueue twice

[Dave Jiang]

On 11/10/26 7:10 PM, Yao Kai wrote:
> If idxd_probe() fails after idxd_setup_internals() succeeds,
> idxd_cleanup_internals() destroys idxd->wq. The PCI probe error path
> then calls idxd_free(), whose put_device() invokes
> idxd_conf_device_release() and destroys the same workqueue again.
> The err_evl path in idxd_setup_internals() has the same problem.
> This can corrupt the workqueue list or access freed memory.
> 
> Clear idxd->wq after both error-path destroy_workqueue() calls and
> only destroy a non-NULL workqueue in the release callback. The NULL
> check also handles failures before the workqueue is created, while
> preserving its destruction on normal device removal.
> 
> Fixes: 3d33de353b1f ("dmaengine: idxd: Fix not releasing workqueue on .release()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yao Kai <yaokai34@huawei.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>

> ---
>  drivers/dma/idxd/init.c  | 2 ++
>  drivers/dma/idxd/sysfs.c | 3 ++-
>  2 files changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
> index 4b827a329756..ffbc5a74be6e 100644
> --- a/drivers/dma/idxd/init.c
> +++ b/drivers/dma/idxd/init.c
> @@ -389,6 +389,7 @@ static void idxd_cleanup_internals(struct idxd_device *idxd)
>  	idxd_clean_engines(idxd);
>  	idxd_clean_wqs(idxd);
>  	destroy_workqueue(idxd->wq);
> +	idxd->wq = NULL;
>  }
>  
>  static int idxd_init_evl(struct idxd_device *idxd)
> @@ -460,6 +461,7 @@ static int idxd_setup_internals(struct idxd_device *idxd)
>  
>   err_evl:
>  	destroy_workqueue(idxd->wq);
> +	idxd->wq = NULL;
>   err_wkq_create:
>  	idxd_clean_groups(idxd);
>   err_group:
> diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
> index 6d251095c350..d5ffc641c856 100644
> --- a/drivers/dma/idxd/sysfs.c
> +++ b/drivers/dma/idxd/sysfs.c
> @@ -1836,7 +1836,8 @@ static void idxd_conf_device_release(struct device *dev)
>  {
>  	struct idxd_device *idxd = confdev_to_idxd(dev);
>  
> -	destroy_workqueue(idxd->wq);
> +	if (idxd->wq)
> +		destroy_workqueue(idxd->wq);
>  	kfree(idxd->groups);
>  	bitmap_free(idxd->wq_enable_map);
>  	kfree(idxd->wqs);