* [PATCH] dmaengine: Free channel ID after device_unregister()
@ 2026-11-10 10:16 zhejun_huang
2026-11-10 14:51 ` Frank Li
2026-11-11 3:37 ` Yao Yuan
0 siblings, 2 replies; 6+ messages in thread
From: zhejun_huang @ 2026-11-10 10:16 UTC (permalink / raw)
To: Vinod Koul; +Cc: Frank Li, dmaengine, linux-kernel, Zhejun Huang, stable
From: Zhejun Huang <zhejun_huang@linux.alibaba.com>
__dma_async_device_channel_unregister() frees the channel ID before calling
device_unregister(). Between ida_free() and device_del() a concurrent
__dma_async_device_channel_register() on the same device can reallocate the
ID and try to register a device with the same name while the old one is
still present, failing with -EEXIST.
This is reachable in practice: idxd calls these functions from its
per-workqueue probe and remove callbacks, which are only serialized by a
per-wq mutex. Enabling one wq while another is being removed therefore
runs them concurrently on the same dma_device.
Move ida_free() after device_unregister() so that device_del() removes the
name before the ID becomes reusable.
Fixes: 0821009445a8 ("dmaengine: fix channel index enumeration")
Cc: <stable@vger.kernel.org> # 5.7+
Signed-off-by: Zhejun Huang <zhejun_huang@linux.alibaba.com>
---
drivers/dma/dmaengine.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 34be53487a21..2642abf105d7 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
device->chancnt--;
chan->chan_dev->chan = NULL;
mutex_unlock(&dma_list_mutex);
- ida_free(&device->chan_ida, chan->chan_id);
device_unregister(dmaengine_chan_dev(chan));
+ ida_free(&device->chan_ida, chan->chan_id);
free_percpu(chan->local);
}
base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] dmaengine: Free channel ID after device_unregister()
2026-11-10 10:16 [PATCH] dmaengine: Free channel ID after device_unregister() zhejun_huang
@ 2026-11-10 14:51 ` Frank Li
2026-11-11 3:37 ` Yao Yuan
1 sibling, 0 replies; 6+ messages in thread
From: Frank Li @ 2026-11-10 14:51 UTC (permalink / raw)
To: zhejun_huang; +Cc: Vinod Koul, Frank Li, dmaengine, linux-kernel, stable
On Tue, Nov 10, 2026 at 06:16:07PM +0800, zhejun_huang@linux.alibaba.com wrote:
>
> From: Zhejun Huang <zhejun_huang@linux.alibaba.com>
>
> __dma_async_device_channel_unregister() frees the channel ID before calling
> device_unregister(). Between ida_free() and device_del() a concurrent
> __dma_async_device_channel_register() on the same device can reallocate the
> ID and try to register a device with the same name while the old one is
> still present, failing with -EEXIST.
>
> This is reachable in practice: idxd calls these functions from its
> per-workqueue probe and remove callbacks, which are only serialized by a
> per-wq mutex. Enabling one wq while another is being removed therefore
> runs them concurrently on the same dma_device.
>
> Move ida_free() after device_unregister() so that device_del() removes the
> name before the ID becomes reusable.
>
> Fixes: 0821009445a8 ("dmaengine: fix channel index enumeration")
> Cc: <stable@vger.kernel.org> # 5.7+
> Signed-off-by: Zhejun Huang <zhejun_huang@linux.alibaba.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
> ---
> drivers/dma/dmaengine.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
> index 34be53487a21..2642abf105d7 100644
> --- a/drivers/dma/dmaengine.c
> +++ b/drivers/dma/dmaengine.c
> @@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
> device->chancnt--;
> chan->chan_dev->chan = NULL;
> mutex_unlock(&dma_list_mutex);
> - ida_free(&device->chan_ida, chan->chan_id);
> device_unregister(dmaengine_chan_dev(chan));
> + ida_free(&device->chan_ida, chan->chan_id);
> free_percpu(chan->local);
> }
>
>
> base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
> --
> 2.50.1 (Apple Git-155)
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] dmaengine: Free channel ID after device_unregister()
2026-11-10 10:16 [PATCH] dmaengine: Free channel ID after device_unregister() zhejun_huang
2026-11-10 14:51 ` Frank Li
@ 2026-11-11 3:37 ` Yao Yuan
1 sibling, 0 replies; 6+ messages in thread
From: Yao Yuan @ 2026-11-11 3:37 UTC (permalink / raw)
To: zhejun_huang; +Cc: Vinod Koul, Frank Li, dmaengine, linux-kernel, stable
On Tue, Nov 10, 2026 at 06:16:07PM +0800, zhejun_huang@linux.alibaba.com wrote:
> From: Zhejun Huang <zhejun_huang@linux.alibaba.com>
>
> __dma_async_device_channel_unregister() frees the channel ID before calling
> device_unregister(). Between ida_free() and device_del() a concurrent
> __dma_async_device_channel_register() on the same device can reallocate the
> ID and try to register a device with the same name while the old one is
> still present, failing with -EEXIST.
>
> This is reachable in practice: idxd calls these functions from its
> per-workqueue probe and remove callbacks, which are only serialized by a
> per-wq mutex. Enabling one wq while another is being removed therefore
> runs them concurrently on the same dma_device.
>
> Move ida_free() after device_unregister() so that device_del() removes the
> name before the ID becomes reusable.
>
> Fixes: 0821009445a8 ("dmaengine: fix channel index enumeration")
> Cc: <stable@vger.kernel.org> # 5.7+
> Signed-off-by: Zhejun Huang <zhejun_huang@linux.alibaba.com>
> ---
> drivers/dma/dmaengine.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
> index 34be53487a21..2642abf105d7 100644
> --- a/drivers/dma/dmaengine.c
> +++ b/drivers/dma/dmaengine.c
> @@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
> device->chancnt--;
> chan->chan_dev->chan = NULL;
> mutex_unlock(&dma_list_mutex);
> - ida_free(&device->chan_ida, chan->chan_id);
> device_unregister(dmaengine_chan_dev(chan));
> + ida_free(&device->chan_ida, chan->chan_id);
Reviewed-by: Yuan Yao <yaoyuan@linux.alibaba.com>
> free_percpu(chan->local);
> }
>
>
> base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
> --
> 2.50.1 (Apple Git-155)
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] dmaengine: Free channel ID after device_unregister()
@ 2026-11-10 10:12 zhejun_huang
0 siblings, 0 replies; 6+ messages in thread
From: zhejun_huang @ 2026-11-10 10:12 UTC (permalink / raw)
To: zhejun_huang; +Cc: stable
From: Zhejun Huang <zhejun_huang@linux.alibaba.com>
__dma_async_device_channel_unregister() frees the channel ID before calling
device_unregister(). Between ida_free() and device_del() a concurrent
__dma_async_device_channel_register() on the same device can reallocate the
ID and try to register a device with the same name while the old one is
still present, failing with -EEXIST.
This is reachable in practice: idxd calls these functions from its
per-workqueue probe and remove callbacks, which are only serialized by a
per-wq mutex. Enabling one wq while another is being removed therefore
runs them concurrently on the same dma_device.
Move ida_free() after device_unregister() so that device_del() removes the
name before the ID becomes reusable.
Fixes: 0821009445a8 ("dmaengine: fix channel index enumeration")
Cc: <stable@vger.kernel.org> # 5.7+
Signed-off-by: Zhejun Huang <zhejun_huang@linux.alibaba.com>
---
drivers/dma/dmaengine.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 34be53487a21..2642abf105d7 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
device->chancnt--;
chan->chan_dev->chan = NULL;
mutex_unlock(&dma_list_mutex);
- ida_free(&device->chan_ida, chan->chan_id);
device_unregister(dmaengine_chan_dev(chan));
+ ida_free(&device->chan_ida, chan->chan_id);
free_percpu(chan->local);
}
base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] dmaengine: Free channel ID after device_unregister()
@ 2026-11-10 10:00 zhejun_huang
0 siblings, 0 replies; 6+ messages in thread
From: zhejun_huang @ 2026-11-10 10:00 UTC (permalink / raw)
To: zhejun_huang; +Cc: stable
From: Zhejun Huang <zhejun_huang@linux.alibaba.com>
__dma_async_device_channel_unregister() frees the channel ID before calling
device_unregister(). Between ida_free() and device_del() a concurrent
__dma_async_device_channel_register() on the same device can reallocate the
ID and try to register a device with the same name while the old one is
still present, failing with -EEXIST.
This is reachable in practice: idxd calls these functions from its
per-workqueue probe and remove callbacks, which are only serialized by a
per-wq mutex. Enabling one wq while another is being removed therefore
runs them concurrently on the same dma_device.
Move ida_free() after device_unregister() so that device_del() removes the
name before the ID becomes reusable.
Fixes: 0821009445a8 ("dmaengine: fix channel index enumeration")
Cc: <stable@vger.kernel.org> # 5.7+
Signed-off-by: Zhejun Huang <zhejun_huang@linux.alibaba.com>
---
drivers/dma/dmaengine.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 34be53487a21..2642abf105d7 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
device->chancnt--;
chan->chan_dev->chan = NULL;
mutex_unlock(&dma_list_mutex);
- ida_free(&device->chan_ida, chan->chan_id);
device_unregister(dmaengine_chan_dev(chan));
+ ida_free(&device->chan_ida, chan->chan_id);
free_percpu(chan->local);
}
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] dmaengine: Free channel ID after device_unregister()
@ 2026-11-10 9:47 zhejun_huang
0 siblings, 0 replies; 6+ messages in thread
From: zhejun_huang @ 2026-11-10 9:47 UTC (permalink / raw)
To: zhejun_huang; +Cc: stable
From: Zhejun Huang <zhejun_huang@linux.alibaba.com>
__dma_async_device_channel_unregister() frees the channel ID before calling
device_unregister(). Between ida_free() and device_del() a concurrent
__dma_async_device_channel_register() on the same device can reallocate the
ID and try to register a device with the same name while the old one is
still present, failing with -EEXIST.
This is reachable in practice: idxd, the only in-tree user of the dynamic
channel API, calls these functions from its per-workqueue probe and remove
callbacks, which are only serialized by a per-wq mutex. Enabling one wq
while another is being removed therefore runs them concurrently on the
same dma_device.
Move ida_free() after device_unregister() so that device_del() removes the
name before the ID becomes reusable. This restores the ordering that
existed before the IDA was introduced, when the ID was freed from the
device release callback.
Fixes: 0821009445a8 ("dmaengine: fix channel index enumeration")
Cc: <stable@vger.kernel.org> # 5.7+
Signed-off-by: Zhejun Huang <zhejun_huang@linux.alibaba.com>
---
drivers/dma/dmaengine.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 34be53487a21..2642abf105d7 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1171,8 +1171,8 @@ static void __dma_async_device_channel_unregister(struct dma_device *device,
device->chancnt--;
chan->chan_dev->chan = NULL;
mutex_unlock(&dma_list_mutex);
- ida_free(&device->chan_ida, chan->chan_id);
device_unregister(dmaengine_chan_dev(chan));
+ ida_free(&device->chan_ida, chan->chan_id);
free_percpu(chan->local);
}
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-11-11 3:37 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-10 10:16 [PATCH] dmaengine: Free channel ID after device_unregister() zhejun_huang
2026-11-10 14:51 ` Frank Li
2026-11-11 3:37 ` Yao Yuan
-- strict thread matches above, loose matches on Subject: below --
2026-11-10 10:12 zhejun_huang
2026-11-10 10:00 zhejun_huang
2026-11-10 9:47 zhejun_huang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox