Running IDXD workloads in a container with the /dev directory mounted can
trigger a call trace or even a kernel panic when the parent process of the
container is terminated.

This issue occurs because, under certain configurations, Docker does not
properly propagate the mount replica back to the original mount point.

In this case, when the user driver detaches, the WQ is destroyed but it
still calls destroy_workqueue() attempting to completes all pending work.
It's necessary to check wq->wq and skip the drain if it no longer exists.

Signed-off-by: Yi Sun <yi.sun@intel.com>

diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
index ff94ee892339..a202fe4937a7 100644
--- a/drivers/dma/idxd/cdev.c
+++ b/drivers/dma/idxd/cdev.c
@@ -349,7 +349,9 @@ static void idxd_cdev_evl_drain_pasid(struct idxd_wq *wq, u32 pasid)
 			set_bit(h, evl->bmap);
 		h = (h + 1) % size;
 	}
-	drain_workqueue(wq->wq);
+	if (wq->wq)
+		drain_workqueue(wq->wq);
+
 	mutex_unlock(&evl->lock);
 }
 
-- 
2.43.0

On Fri, 09 May 2025 08:03:04 +0800, Yi Sun wrote:
> Running IDXD workloads in a container with the /dev directory mounted can
> trigger a call trace or even a kernel panic when the parent process of the
> container is terminated.
> 
> This issue occurs because, under certain configurations, Docker does not
> properly propagate the mount replica back to the original mount point.
> 
> [...]

Applied, thanks!

[1/1] dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
      commit: 17502e7d7b7113346296f6758324798d536c31fd

Best regards,
-- 
~Vinod

On 5/8/25 5:03 PM, Yi Sun wrote:
> Running IDXD workloads in a container with the /dev directory mounted can
> trigger a call trace or even a kernel panic when the parent process of the
> container is terminated.
> 
> This issue occurs because, under certain configurations, Docker does not
> properly propagate the mount replica back to the original mount point.
> 
> In this case, when the user driver detaches, the WQ is destroyed but it

I would be more specific. wq->wq (workqueue) that is allocated by the cdev user driver during ->probe() is destroyed when the driver is unbound.

> still calls destroy_workqueue() attempting to completes all pending work.
> It's necessary to check wq->wq and skip the drain if it no longer exists.
> 
> Signed-off-by: Yi Sun <yi.sun@intel.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>

> 
> diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
> index ff94ee892339..a202fe4937a7 100644
> --- a/drivers/dma/idxd/cdev.c
> +++ b/drivers/dma/idxd/cdev.c
> @@ -349,7 +349,9 @@ static void idxd_cdev_evl_drain_pasid(struct idxd_wq *wq, u32 pasid)
>  			set_bit(h, evl->bmap);
>  		h = (h + 1) % size;
>  	}
> -	drain_workqueue(wq->wq);
> +	if (wq->wq)
> +		drain_workqueue(wq->wq);
> +
>  	mutex_unlock(&evl->lock);
>  }
>

On 5/8/2025 5:07 PM, Dave Jiang wrote:
>
> On 5/8/25 5:03 PM, Yi Sun wrote:
>> Running IDXD workloads in a container with the /dev directory mounted can
>> trigger a call trace or even a kernel panic when the parent process of the
>> container is terminated.
>>
>> This issue occurs because, under certain configurations, Docker does not
>> properly propagate the mount replica back to the original mount point.
>>
>> In this case, when the user driver detaches, the WQ is destroyed but it
> I would be more specific. wq->wq (workqueue) that is allocated by the cdev user driver during ->probe() is destroyed when the driver is unbound.
>
>> still calls destroy_workqueue() attempting to completes all pending work.
>> It's necessary to check wq->wq and skip the drain if it no longer exists.
>>
>> Signed-off-by: Yi Sun <yi.sun@intel.com>
> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
>
>> diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
>> index ff94ee892339..a202fe4937a7 100644
>> --- a/drivers/dma/idxd/cdev.c
>> +++ b/drivers/dma/idxd/cdev.c
>> @@ -349,7 +349,9 @@ static void idxd_cdev_evl_drain_pasid(struct idxd_wq *wq, u32 pasid)
>>   			set_bit(h, evl->bmap);
>>   		h = (h + 1) % size;
>>   	}
>> -	drain_workqueue(wq->wq);
>> +	if (wq->wq)
>> +		drain_workqueue(wq->wq);
>> +
>>   	mutex_unlock(&evl->lock);
>>   }
>>