From: Fenghua Yu <fenghuay@nvidia.com>
To: Yi Sun <yi.sun@intel.com>,
vinicius.gomes@intel.com, dmaengine@vger.kernel.org,
linux-kernel@vger.kernel.org
Cc: dave.jiang@intel.com, gordon.jin@intel.com
Subject: Re: [PATCH v3 2/2] dmaengine: idxd: Fix refcount underflow on module unload
Date: Tue, 17 Jun 2025 14:58:15 -0700 [thread overview]
Message-ID: <39398407-009e-4afe-acb6-e3de931627d7@nvidia.com> (raw)
In-Reply-To: <20250617102712.727333-3-yi.sun@intel.com>
Hi, Yi,
On 6/17/25 03:27, Yi Sun wrote:
> A recent refactor introduced a misplaced put_device() call, leading to a
> reference count underflow during module unload.
>
> There is no need to add additional put_device() calls for idxd groups,
> engines, or workqueues. Although commit a409e919ca3 claims:"Note, this
> also fixes the missing put_device() for idxd groups, engines, and wqs."
> It appears no such omission existed. The required cleanup is already
> handled by the call chain:
>
>
> Extend idxd_cleanup() to perform the necessary cleanup, and remove
> idxd_cleanup_internals() which was not originally part of the driver
> unload path and introduced unintended reference count underflow.
>
> Fixes: a409e919ca32 ("dmaengine: idxd: Refactor remove call with idxd_cleanup() helper")
> Signed-off-by: Yi Sun <yi.sun@intel.com>
>
> diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
> index 40cc9c070081..40f4bf446763 100644
> --- a/drivers/dma/idxd/init.c
> +++ b/drivers/dma/idxd/init.c
> @@ -1292,7 +1292,10 @@ static void idxd_remove(struct pci_dev *pdev)
> device_unregister(idxd_confdev(idxd));
> idxd_shutdown(pdev);
> idxd_device_remove_debugfs(idxd);
> - idxd_cleanup(idxd);
> + perfmon_pmu_remove(idxd);
> + idxd_cleanup_interrupts(idxd);
> + if (device_pasid_enabled(idxd))
> + idxd_disable_system_pasid(idxd);
>
This will hit memory leak issue.
idxd_remove_internals() does not only put_device() but also free
allocated memory for wqs, engines, groups. Without calling
idxd_remove_internals(), the allocated memory is leaked.
I think a right fix is to remove the put_device() in
idxd_cleanup_wqs/engines/groups() because:
1. idxd_setup_wqs/engines/groups() does not call get_device(). Their
counterpart idxd_cleanup_wqs/engines/groups() shouldn't call put_device().
2. Fix the issue mentioned in this patch while there is no memory leak
issue.
> pci_iounmap(pdev, idxd->reg_base);
> put_device(idxd_confdev(idxd));
> pci_disable_device(pdev);
Thanks.
-Fenghua
next prev parent reply other threads:[~2025-06-17 21:58 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-17 10:27 [PATCH v3 0/2] dmaengine: idxd: Fix refcount and cleanup issues on module unload Yi Sun
2025-06-17 10:27 ` [PATCH v3 1/2] dmaengine: idxd: Remove improper idxd_free Yi Sun
2025-06-17 22:13 ` Fenghua Yu
2025-07-27 9:02 ` Yi Sun
2025-07-28 8:21 ` Shuai Xue
2025-06-17 10:27 ` [PATCH v3 2/2] dmaengine: idxd: Fix refcount underflow on module unload Yi Sun
2025-06-17 21:58 ` Fenghua Yu [this message]
2025-06-18 0:38 ` Vinicius Costa Gomes
2025-07-27 9:16 ` Yi Sun
2025-07-28 8:40 ` Shuai Xue
2025-07-28 11:43 ` Yi Sun
2025-07-29 2:46 ` Shuai Xue
2025-07-29 3:15 ` Yi Sun
2025-07-29 6:00 ` Shuai Xue
2025-07-31 0:17 ` Vinicius Costa Gomes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=39398407-009e-4afe-acb6-e3de931627d7@nvidia.com \
--to=fenghuay@nvidia.com \
--cc=dave.jiang@intel.com \
--cc=dmaengine@vger.kernel.org \
--cc=gordon.jin@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=vinicius.gomes@intel.com \
--cc=yi.sun@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox