linux-kernel - Re: [PATCH 7/9] dmaengine: idxd: Fix memory leak when a wq is reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <11f47523-73dd-4504-be13-b57fba141c62@intel.com>
Date: Wed, 6 Aug 2025 10:25:51 -0700
From: Dave Jiang <dave.jiang@...el.com>
To: Vinicius Costa Gomes <vinicius.gomes@...el.com>,
 Vinod Koul <vkoul@...nel.org>, Dan Williams <dan.j.williams@...el.com>,
 Fenghua Yu <fenghuay@...dia.com>
Cc: dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 7/9] dmaengine: idxd: Fix memory leak when a wq is reset



On 8/4/25 6:27 PM, Vinicius Costa Gomes wrote:
> idxd_wq_disable_cleanup() which is called from the reset path for a
> workqueue, sets the wq type to NONE, which for other parts of the
> driver mean that the wq is empty (all its resources were released).
> 
> Only set the wq type to NONE after its resources are released.
> 
> Fixes: da32b28c95a7 ("dmaengine: idxd: cleanup workqueue config after disabling")
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@...el.com>

Reviewed-by: Dave Jiang <dave.jiang@...el.com>
> ---
>  drivers/dma/idxd/device.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
> index 287cf3bf1f5a2efdc9037968e9a4eed506e489c3..8f6afcba840ed7128259ad6b58b2fd967b0c151c 100644
> --- a/drivers/dma/idxd/device.c
> +++ b/drivers/dma/idxd/device.c
> @@ -174,6 +174,7 @@ void idxd_wq_free_resources(struct idxd_wq *wq)
>  	free_descs(wq);
>  	dma_free_coherent(dev, wq->compls_size, wq->compls, wq->compls_addr);
>  	sbitmap_queue_free(&wq->sbq);
> +	wq->type = IDXD_WQT_NONE;
>  }
>  EXPORT_SYMBOL_NS_GPL(idxd_wq_free_resources, "IDXD");
>  
> @@ -367,7 +368,6 @@ static void idxd_wq_disable_cleanup(struct idxd_wq *wq)
>  	lockdep_assert_held(&wq->wq_lock);
>  	wq->state = IDXD_WQ_DISABLED;
>  	memset(wq->wqcfg, 0, idxd->wqcfg_size);
> -	wq->type = IDXD_WQT_NONE;
>  	wq->threshold = 0;
>  	wq->priority = 0;
>  	wq->enqcmds_retries = IDXD_ENQCMDS_RETRIES;
> @@ -1540,7 +1540,6 @@ void idxd_drv_disable_wq(struct idxd_wq *wq)
>  	idxd_wq_reset(wq);
>  	idxd_wq_free_resources(wq);
>  	percpu_ref_exit(&wq->wq_active);
> -	wq->type = IDXD_WQT_NONE;
>  	wq->client_count = 0;
>  }
>  EXPORT_SYMBOL_NS_GPL(idxd_drv_disable_wq, "IDXD");
>