Re: [PATCH 5.15 386/570] dmaengine: idxd: Fix not releasing workqueue on .release()

Harshit Mogalapalli
2026-04-15T11:42:26Z

Hi,

On 13/04/26 21:28, Greg Kroah-Hartman wrote:
> 5.15-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
>
> [ Upstream commit 3d33de353b1ff9023d5ec73b9becf80ea87af695 ]
>
> The workqueue associated with an DSA/IAA device is not released when
> the object is freed.
>
> Fixes: 47c16ac27d4c ("dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime")
> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
> Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-7-7ed70658a9d1@intel.com
> Signed-off-by: Vinod Koul <vkoul@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/dma/idxd/sysfs.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
> index 489a9d8850764..ee208dfdd0cb5 100644
> --- a/drivers/dma/idxd/sysfs.c
> +++ b/drivers/dma/idxd/sysfs.c
> @@ -1271,6 +1271,7 @@ static void idxd_conf_device_release(struct device *dev)
> {
> struct idxd_device *idxd = confdev_to_idxd(dev);
>
> + destroy_workqueue(idxd->wq);

I have run an AI assisted backport review and it spotted an issue: I
have taken a look and the issues goes like:

in 5.15.y code base:

the remove() function is something like this:

get_device(idxd_confdev(idxd));
device_unregister(idxd_confdev(idxd));
...
destroy_workqueue(idxd->wq);
...
put_device(idxd_confdev(idxd));

put_device() --> release() call and this patch tries to add
destroy_workqueue(idxd->wq); so that's destroying it twice.

idxd_remove()
-> destroy_workqueue(idxd->wq) // first destroy
-> put_device(idxd_confdev(idxd))
-> idxd_conf_device_release()
-> destroy_workqueue(idxd->wq) // second destroy

This changed in ustream during the refactoring commit and followup fixes
of commit: a409e919ca32 ("dmaengine: idxd: Refactor remove call with
idxd_cleanup() helper"), so upstream (6.15-rc1 origin, it is backported
to 6.6-rc1) doesn't have this problem. looks like we will have same
problem in 6.1.y as well. I just checked, it has the same problem

Thanks,
Harshit

> kfree(idxd->groups);
> kfree(idxd->wqs);
> kfree(idxd->engines);