[PATCH v1] dmaengine: idxd: fix deadlock and double free in idxd_cdev_open()

[PATCH v1] dmaengine: idxd: fix deadlock and double free in idxd_cdev_open()

[Yuho Choi]

The failed_dev_add and failed_dev_name error paths in idxd_cdev_open()
call put_device(fdev) while still holding wq->wq_lock. This triggers
idxd_file_dev_release() synchronously, which calls
mutex_lock(&wq->wq_lock) — deadlocking on the same mutex.

Additionally, the original code fell through from failed_dev_add and
failed_dev_name to the failed: label, which called kfree(ctx) a second
time after idxd_file_dev_release() had already freed it. The subsequent
idxd_xa_pasid_remove(ctx) then uses the freed pointer.

Fix both issues by releasing wq_lock before put_device(fdev) and
returning immediately, so the release callback acquires the lock without
contention and no further cleanup is attempted on the freed context.

Fixes: e6fd6d7e5f0fe ("dmaengine: idxd: add a device to represent the file opened")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/dma/idxd/cdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
index 0366c7cf35020..19a449333782b 100644
--- a/drivers/dma/idxd/cdev.c
+++ b/drivers/dma/idxd/cdev.c
@@ -307,7 +307,9 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp)
 
 failed_dev_add:
 failed_dev_name:
+	mutex_unlock(&wq->wq_lock);
 	put_device(fdev);
+	return rc;
 failed_ida:
 failed_set_pasid:
 	if (device_user_pasid_enabled(idxd))
-- 
2.50.1 (Apple Git-155)