[PATCH] dmaengine: Free channel ID after device_unregister()

[PATCH] dmaengine: Free channel ID after device_unregister()

[zhejun_huang]

From: Zhejun Huang <zhejun_huang@linux.alibaba.com>

__dma_async_device_channel_unregister() frees the channel ID before calling
device_unregister(). Between ida_free() and device_del() a concurrent
__dma_async_device_channel_register() on the same device can reallocate the
ID and try to register a device with the same name while the old one is
still present, failing with -EEXIST.

This is reachable in practice: idxd calls these functions from its
per-workqueue probe and remove callbacks, which are only serialized by a
per-wq mutex. Enabling one wq while another is being removed therefore
runs them concurrently on the same dma_device.

Move ida_free() after device_unregister() so that device_del() removes the
name before the ID becomes reusable.

Fixes: 0821009445a8 ("dmaengine: fix channel index enumeration")
Cc: <stable@vger.kernel.org> # 5.7+
Signed-off-by: Zhejun Huang <zhejun_huang@linux.alibaba.com>
---
 drivers/dma/dmaengine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 34be53487a21..2642abf105d7 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
 	device->chancnt--;
 	chan->chan_dev->chan = NULL;
 	mutex_unlock(&dma_list_mutex);
-	ida_free(&device->chan_ida, chan->chan_id);
 	device_unregister(dmaengine_chan_dev(chan));
+	ida_free(&device->chan_ida, chan->chan_id);
 	free_percpu(chan->local);
 }
 

base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] dmaengine: Free channel ID after device_unregister()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] dmaengine: IDA leak on error path in
  dma_async_device_register() [1]
--

commit e2b5dc17e7cb70401abfdf640998b8028522d873
Author: Zhejun Huang <zhejun_huang@linux.alibaba.com>

dmaengine: Free channel ID after device_unregister()

This commit moves the ida_free() call in
__dma_async_device_channel_unregister() after device_unregister() so that a
concurrent channel registration cannot reuse the channel ID before the old
device name is removed.

> diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
> index 34be53487a21d..2642abf105d76 100644
> --- a/drivers/dma/dmaengine.c
> +++ b/drivers/dma/dmaengine.c
> @@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
>  	device->chancnt--;
>  	chan->chan_dev->chan = NULL;
>  	mutex_unlock(&dma_list_mutex);
> -	ida_free(&device->chan_ida, chan->chan_id);
>  	device_unregister(dmaengine_chan_dev(chan));
> +	ida_free(&device->chan_ida, chan->chan_id);
>  	free_percpu(chan->local);
>  }

[Severity: Medium]
This problem wasn't introduced by this patch, but does the error path in
dma_async_device_register() leak IDs from device->chan_ida and dma_ida
[1]?

drivers/dma/dmaengine.c:dma_async_device_register() {
    ...
err_out:
	/* if we never registered a channel just release the idr */
	if (!device->chancnt) {
		ida_free(&dma_ida, device->dev_id);
		return rc;
	}

	list_for_each_entry(chan, &device->channels, device_node) {
		if (chan->local == NULL)
			continue;
		mutex_lock(&dma_list_mutex);
		chan->chan_dev->chan = NULL;
		mutex_unlock(&dma_list_mutex);
		device_unregister(dmaengine_chan_dev(chan));
		free_percpu(chan->local);
	}
	return rc;
}

If registration fails after at least one channel has been registered (for
example, on a subsequent channel or in dma_chan_get()), device->chancnt is
non-zero.  The open-coded cleanup loop unregisters the channels without
freeing each chan->chan_id or destroying device->chan_ida, and
device->dev_id is never freed from dma_ida.

[1] https://sashiko.dev/#/bug/linux-39bbcde3-023e-41e2-afef-7a2c13f45a17

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110101607.13784-1-zhejun_huang@linux.alibaba.com?part=1

Re: [PATCH] dmaengine: Free channel ID after device_unregister()

[Frank Li]

On Tue, Nov 10, 2026 at 06:16:07PM +0800, zhejun_huang@linux.alibaba.com wrote:
>
> From: Zhejun Huang <zhejun_huang@linux.alibaba.com>
>
> __dma_async_device_channel_unregister() frees the channel ID before calling
> device_unregister(). Between ida_free() and device_del() a concurrent
> __dma_async_device_channel_register() on the same device can reallocate the
> ID and try to register a device with the same name while the old one is
> still present, failing with -EEXIST.
>
> This is reachable in practice: idxd calls these functions from its
> per-workqueue probe and remove callbacks, which are only serialized by a
> per-wq mutex. Enabling one wq while another is being removed therefore
> runs them concurrently on the same dma_device.
>
> Move ida_free() after device_unregister() so that device_del() removes the
> name before the ID becomes reusable.
>
> Fixes: 0821009445a8 ("dmaengine: fix channel index enumeration")
> Cc: <stable@vger.kernel.org> # 5.7+
> Signed-off-by: Zhejun Huang <zhejun_huang@linux.alibaba.com>

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> ---
>  drivers/dma/dmaengine.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
> index 34be53487a21..2642abf105d7 100644
> --- a/drivers/dma/dmaengine.c
> +++ b/drivers/dma/dmaengine.c
> @@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
>         device->chancnt--;
>         chan->chan_dev->chan = NULL;
>         mutex_unlock(&dma_list_mutex);
> -       ida_free(&device->chan_ida, chan->chan_id);
>         device_unregister(dmaengine_chan_dev(chan));
> +       ida_free(&device->chan_ida, chan->chan_id);
>         free_percpu(chan->local);
>  }
>
>
> base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
> --
> 2.50.1 (Apple Git-155)
>

Re: [PATCH] dmaengine: Free channel ID after device_unregister()

[Yao Yuan]

On Tue, Nov 10, 2026 at 06:16:07PM +0800, zhejun_huang@linux.alibaba.com wrote:
> From: Zhejun Huang <zhejun_huang@linux.alibaba.com>
>
> __dma_async_device_channel_unregister() frees the channel ID before calling
> device_unregister(). Between ida_free() and device_del() a concurrent
> __dma_async_device_channel_register() on the same device can reallocate the
> ID and try to register a device with the same name while the old one is
> still present, failing with -EEXIST.
>
> This is reachable in practice: idxd calls these functions from its
> per-workqueue probe and remove callbacks, which are only serialized by a
> per-wq mutex. Enabling one wq while another is being removed therefore
> runs them concurrently on the same dma_device.
>
> Move ida_free() after device_unregister() so that device_del() removes the
> name before the ID becomes reusable.
>
> Fixes: 0821009445a8 ("dmaengine: fix channel index enumeration")
> Cc: <stable@vger.kernel.org> # 5.7+
> Signed-off-by: Zhejun Huang <zhejun_huang@linux.alibaba.com>
> ---
>  drivers/dma/dmaengine.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
> index 34be53487a21..2642abf105d7 100644
> --- a/drivers/dma/dmaengine.c
> +++ b/drivers/dma/dmaengine.c
> @@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
>  	device->chancnt--;
>  	chan->chan_dev->chan = NULL;
>  	mutex_unlock(&dma_list_mutex);
> -	ida_free(&device->chan_ida, chan->chan_id);
>  	device_unregister(dmaengine_chan_dev(chan));
> +	ida_free(&device->chan_ida, chan->chan_id);

Reviewed-by: Yuan Yao <yaoyuan@linux.alibaba.com>

>  	free_percpu(chan->local);
>  }
>
>
> base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
> --
> 2.50.1 (Apple Git-155)
>