[PATCH 6.6.y v2 0/2] dmaengine: idxd: fix event log crash and memory leak on FLR

[PATCH 6.6.y v2 0/2] dmaengine: idxd: fix event log crash and memory leak on FLR

[Wenshan Lan]

v1->v2: add commit 52d2edea0d63c ("dmaengine: idxd: Fix crash when the event log is disabled")

Backport of two upstream fixes for the dmaengine idxd event log handling
in drivers/dma/idxd/device.c. These fix a crash and a memory leak when
the event log is disabled or a Function Level Reset (FLR) occurs.

Backport notes:
  - Commit 8a5084ab3af8: The upstream fix also touches idxd_device_config_restore(),
    which does not exist in v6.6 (introduced in 6.14 via commit 6078a315aec1). Only
    the idxd_device_evl_free() NULL check portion was backported.
  - Commit 2ea19af4a590: Clean cherry-pick, no conflicts.

Vinicius Costa Gomes (2):
  dmaengine: idxd: Fix crash when the event log is disabled
  dmaengine: idxd: Fix leaking event log memory

 drivers/dma/idxd/device.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

-- 
2.43.0

[PATCH 6.6.y v2 1/2] dmaengine: idxd: Fix crash when the event log is disabled

[Wenshan Lan]

From: Vinicius Costa Gomes <vinicius.gomes@intel.com>

[ Upstream commit 52d2edea0d63c935e82631e4b9e4a94eccf97b5b ]

If reporting errors to the event log is not supported by the hardware,
and an error that causes Function Level Reset (FLR) is received, the
driver will try to restore the event log even if it was not allocated.

Also, only try to free the event log if it was properly allocated.

Fixes: 6078a315aec1 ("dmaengine: idxd: Add idxd_device_config_save() and idxd_device_config_restore() helpers")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-2-7ed70658a9d1@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
[ Only the idxd_device_evl_free() NULL check portion was backported in v6.6.
idxd_device_config_restore() does not exist in v6.6. It was introduced 
in 6.14. ]
Signed-off-by: Wenshan Lan <jetlan9@163.com>
---
 drivers/dma/idxd/device.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
index 44bbeb3acd14..e769e1f0d28b 100644
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -810,6 +810,9 @@ static void idxd_device_evl_free(struct idxd_device *idxd)
 	struct device *dev = &idxd->pdev->dev;
 	struct idxd_evl *evl = idxd->evl;
 
+	if (!evl)
+		return;
+
 	gencfg.bits = ioread32(idxd->reg_base + IDXD_GENCFG_OFFSET);
 	if (!gencfg.evl_en)
 		return;
-- 
2.43.0

[PATCH 6.6.y v2 2/2] dmaengine: idxd: Fix leaking event log memory

[Wenshan Lan]

From: Vinicius Costa Gomes <vinicius.gomes@intel.com>

[ Upstream commit ee66bc29578391c9b48523dc9119af67bd5c7c0f ]

During the device remove process, the device is reset, causing the
configuration registers to go back to their default state, which is
zero. As the driver is checking if the event log support was enabled
before deallocating, it will fail if a reset happened before.

Do not check if the support was enabled, the check for 'idxd->evl'
being valid (only allocated if the HW capability is available) is
enough.

Fixes: 244da66cda35 ("dmaengine: idxd: setup event log configuration")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-10-7ed70658a9d1@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Wenshan Lan <jetlan9@163.com>
---
 drivers/dma/idxd/device.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
index e769e1f0d28b..13af4ef2f43f 100644
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -813,10 +813,6 @@ static void idxd_device_evl_free(struct idxd_device *idxd)
 	if (!evl)
 		return;
 
-	gencfg.bits = ioread32(idxd->reg_base + IDXD_GENCFG_OFFSET);
-	if (!gencfg.evl_en)
-		return;
-
 	mutex_lock(&evl->lock);
 	gencfg.evl_en = 0;
 	iowrite32(gencfg.bits, idxd->reg_base + IDXD_GENCFG_OFFSET);
-- 
2.43.0

Re: [PATCH 6.6.y v2 0/2] dmaengine: idxd: fix event log crash and memory leak on FLR

[Sasha Levin]

> Changes since v1:
>   - Added prerequisite patch backporting 52d2edea0d63 ("dmaengine:
>     idxd: Fix crash when the event log is disabled") so that the
>     ee66bc295783 fix doesn't regress hardware without event-log
>     support.
>   - Documented the partial backport of 52d2edea0d63 (the
>     idxd_device_config_restore() hunk is dropped because that helper
>     does not exist on 6.6).

Both patches queued for 6.6.y, thanks for the quick v2 turnaround.

--
Thanks,
Sasha