[PATCH 6.6.y] dmaengine: idxd: Fix leaking event log memory

[PATCH 6.6.y] dmaengine: idxd: Fix leaking event log memory

[Wenshan Lan]

From: Vinicius Costa Gomes <vinicius.gomes@intel.com>

[ Upstream commit ee66bc29578391c9b48523dc9119af67bd5c7c0f ]

During the device remove process, the device is reset, causing the
configuration registers to go back to their default state, which is
zero. As the driver is checking if the event log support was enabled
before deallocating, it will fail if a reset happened before.

Do not check if the support was enabled, the check for 'idxd->evl'
being valid (only allocated if the HW capability is available) is
enough.

Fixes: 244da66cda35 ("dmaengine: idxd: setup event log configuration")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-10-7ed70658a9d1@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
[ Minor context conflict resolved. ]
Signed-off-by: Wenshan Lan <jetlan9@163.com>
---
 drivers/dma/idxd/device.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
index 44bbeb3acd14..10e54a050ea9 100644
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -810,10 +810,6 @@ static void idxd_device_evl_free(struct idxd_device *idxd)
 	struct device *dev = &idxd->pdev->dev;
 	struct idxd_evl *evl = idxd->evl;
 
-	gencfg.bits = ioread32(idxd->reg_base + IDXD_GENCFG_OFFSET);
-	if (!gencfg.evl_en)
-		return;
-
 	mutex_lock(&evl->lock);
 	gencfg.evl_en = 0;
 	iowrite32(gencfg.bits, idxd->reg_base + IDXD_GENCFG_OFFSET);
-- 
2.43.0

Re: [PATCH 6.6.y] dmaengine: idxd: Fix leaking event log memory

[Sasha Levin]

On Thu, May 07, 2026 at 12:04:15PM +0800, Wenshan Lan wrote:
> From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
>
> [ Upstream commit ee66bc29578391c9b48523dc9119af67bd5c7c0f ]
>
> -	gencfg.bits = ioread32(idxd->reg_base + IDXD_GENCFG_OFFSET);
> -	if (!gencfg.evl_en)
> -		return;
> -
>  	mutex_lock(&evl->lock);

This drops the only thing that protects no-evl-capable hardware
(idxd->evl == NULL) from dereferencing evl in idxd_device_evl_free().
On 6.6, idxd_init_evl() returns 0 without allocating evl when
hw.gen_cap.evl_support == 0, and idxd_device_evl_free() is still
reachable in that path, so taking ee66bc29 alone will introduce a
NULL deref on hardware without event-log support.

The required prerequisite is upstream commit 52d2edea0d63c
("dmaengine: idxd: Fix crash when the event log is disabled"), which
adds the "if (!evl) return;" guard at the top of idxd_device_evl_free().
It landed as patch 2 of the same v3 series and is missing from 6.6.y.

Could you resend as a 2-patch series with 52d2edea0d63c as the
prerequisite? Then I'm happy to queue both for 6.6.y.

--
Thanks,
Sasha

Re: [PATCH 6.6.y] dmaengine: idxd: Fix leaking event log memory

[Wenshan Lan]

On 5/9/2026 10:08 AM, Sasha Levin wrote:
> On Thu, May 07, 2026 at 12:04:15PM +0800, Wenshan Lan wrote:
>> From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
>>
>> [ Upstream commit ee66bc29578391c9b48523dc9119af67bd5c7c0f ]
>>
>> -	gencfg.bits = ioread32(idxd->reg_base + IDXD_GENCFG_OFFSET);
>> -	if (!gencfg.evl_en)
>> -		return;
>> -
>>   	mutex_lock(&evl->lock);
> This drops the only thing that protects no-evl-capable hardware
> (idxd->evl == NULL) from dereferencing evl in idxd_device_evl_free().
> On 6.6, idxd_init_evl() returns 0 without allocating evl when
> hw.gen_cap.evl_support == 0, and idxd_device_evl_free() is still
> reachable in that path, so taking ee66bc29 alone will introduce a
> NULL deref on hardware without event-log support.
>
> The required prerequisite is upstream commit 52d2edea0d63c
> ("dmaengine: idxd: Fix crash when the event log is disabled"), which
> adds the "if (!evl) return;" guard at the top of idxd_device_evl_free().
> It landed as patch 2 of the same v3 series and is missing from 6.6.y.
>
> Could you resend as a 2-patch series with 52d2edea0d63c as the
> prerequisite? Then I'm happy to queue both for 6.6.y.

Thank you for your review. I will resend v2.

Wenshan Lan

>
> --
> Thanks,
> Sasha