linux-kernel - Re: [PATCH] dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b54baf68-5c4e-4cad-93c8-560195d063e7@intel.com>
Date: Thu, 8 May 2025 17:07:02 -0700
From: Dave Jiang <dave.jiang@...el.com>
To: Yi Sun <yi.sun@...el.com>, vinicius.gomes@...el.com,
 dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: anil.s.keshavamurthy@...el.com, gordon.jin@...el.com
Subject: Re: [PATCH] dmaengine: idxd: Check availability of workqueue
 allocated by idxd wq driver before using



On 5/8/25 5:03 PM, Yi Sun wrote:
> Running IDXD workloads in a container with the /dev directory mounted can
> trigger a call trace or even a kernel panic when the parent process of the
> container is terminated.
> 
> This issue occurs because, under certain configurations, Docker does not
> properly propagate the mount replica back to the original mount point.
> 
> In this case, when the user driver detaches, the WQ is destroyed but it

I would be more specific. wq->wq (workqueue) that is allocated by the cdev user driver during ->probe() is destroyed when the driver is unbound.

> still calls destroy_workqueue() attempting to completes all pending work.
> It's necessary to check wq->wq and skip the drain if it no longer exists.
> 
> Signed-off-by: Yi Sun <yi.sun@...el.com>

Reviewed-by: Dave Jiang <dave.jiang@...el.com>

> 
> diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
> index ff94ee892339..a202fe4937a7 100644
> --- a/drivers/dma/idxd/cdev.c
> +++ b/drivers/dma/idxd/cdev.c
> @@ -349,7 +349,9 @@ static void idxd_cdev_evl_drain_pasid(struct idxd_wq *wq, u32 pasid)
>  			set_bit(h, evl->bmap);
>  		h = (h + 1) % size;
>  	}
> -	drain_workqueue(wq->wq);
> +	if (wq->wq)
> +		drain_workqueue(wq->wq);
> +
>  	mutex_unlock(&evl->lock);
>  }
>