Commit c311f5e9 authored by Vinicius Costa Gomes's avatar Vinicius Costa Gomes Committed by Vinod Koul
Browse files

dmaengine: idxd: Fix freeing the allocated ida too late 



It can happen that when the cdev .release() is called, the driver
already called ida_destroy(). Move ida_free() to the _del() path.

We see with DEBUG_KOBJECT_RELEASE enabled and forcing an early PCI
unbind.

Fixes: 04922b74 ("dmaengine: idxd: fix cdev setup and free device lifetime issues")
Reviewed-by: default avatarDave Jiang <dave.jiang@intel.com>
Signed-off-by: default avatarVinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-9-7ed70658a9d1@intel.com


Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
parent d9cfb519

drivers/dma/idxd/cdev.c

+4 −4
Original line number Diff line number Diff line
@@ -158,11 +158,7 @@ static const struct device_type idxd_cdev_file_type = { 
static void idxd_cdev_dev_release(struct device *dev)

{

	struct idxd_cdev *idxd_cdev = dev_to_cdev(dev);

	struct idxd_cdev_context *cdev_ctx;

	struct idxd_wq *wq = idxd_cdev->wq;



	cdev_ctx = &ictx[wq->idxd->data->type];

	ida_free(&cdev_ctx->minor_ida, idxd_cdev->minor);

	kfree(idxd_cdev);

}
@@ -582,11 +578,15 @@ int idxd_wq_add_cdev(struct idxd_wq *wq) 


void idxd_wq_del_cdev(struct idxd_wq *wq)

{

	struct idxd_cdev_context *cdev_ctx;

	struct idxd_cdev *idxd_cdev;



	idxd_cdev = wq->idxd_cdev;

	wq->idxd_cdev = NULL;

	cdev_device_del(&idxd_cdev->cdev, cdev_dev(idxd_cdev));



	cdev_ctx = &ictx[wq->idxd->data->type];

	ida_free(&cdev_ctx->minor_ida, idxd_cdev->minor);

	put_device(cdev_dev(idxd_cdev));

}