This patch series addresses two issues related to the device reference
counting and cleanup path in the idxd driver.

Recent changes introduced improper put_device() calls and duplicated
cleanup logic, leading to refcount underflow and potential use-after-free
during module unload.

Patch 1 removes an unnecessary call to idxd_free(), which could result in a
use-after-free, because the function idxd_conf_device_release already
covers everything done in idxd_free. The newly added idxd_free in commit
90022b3 doesn't resolve any memory leaks, but introduces several duplicated
cleanup.

Patch 2 refactors the cleanup to avoid redundant put_device() calls
introduced in commit a409e919ca3. The existing idxd_unregister_devices()
already handles proper device reference release.

Both patches have been verified on hardware platform.

Both patches have been run through `checkpatch.pl`. Patch 2 gets 1 error
and 1 warning. But these appear to be limitations in the checkpatch script
itself, not reflect issues with the patches.

---
Changes in V3:
- Removed function idxd_disable_sva which got removed recently (Vinicius)
Changes in v2:
- Reworded commit messages supplementing the call traces (Vinicius)
- Explain why the put_device are unnecessary. (Vinicius)

Yi Sun (2):
  dmaengine: idxd: Remove improper idxd_free
  dmaengine: idxd: Fix refcount underflow on module unload

 drivers/dma/idxd/init.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

-- 
2.43.0

On Tue, 29 Jul 2025 23:03:11 +0800, Yi Sun wrote:
> This patch series addresses two issues related to the device reference
> counting and cleanup path in the idxd driver.
> 
> Recent changes introduced improper put_device() calls and duplicated
> cleanup logic, leading to refcount underflow and potential use-after-free
> during module unload.
> 
> [...]

Applied, thanks!

[1/2] dmaengine: idxd: Remove improper idxd_free
      commit: f41c538881eec4dcf5961a242097d447f848cda6
[2/2] dmaengine: idxd: Fix refcount underflow on module unload
      commit: b7cb9a034305d52222433fad10c3de10204f29e7

Best regards,
-- 
~Vinod

On Tue, Jul 29, 2025 at 11:03:11PM +0800, Yi Sun wrote:
> This patch series addresses two issues related to the device reference
> counting and cleanup path in the idxd driver.
> 
> Recent changes introduced improper put_device() calls and duplicated
> cleanup logic, leading to refcount underflow and potential use-after-free
> during module unload.
> 
> Patch 1 removes an unnecessary call to idxd_free(), which could result in a
> use-after-free, because the function idxd_conf_device_release already
> covers everything done in idxd_free. The newly added idxd_free in commit
> 90022b3 doesn't resolve any memory leaks, but introduces several duplicated
> cleanup.
> 
> Patch 2 refactors the cleanup to avoid redundant put_device() calls
> introduced in commit a409e919ca3. The existing idxd_unregister_devices()
> already handles proper device reference release.
> 
> Both patches have been verified on hardware platform.
> 
> Both patches have been run through `checkpatch.pl`. Patch 2 gets 1 error
> and 1 warning. But these appear to be limitations in the checkpatch script
> itself, not reflect issues with the patches.
> 
> ---
> Changes in V3:
> - Removed function idxd_disable_sva which got removed recently (Vinicius)
> Changes in v2:
> - Reworded commit messages supplementing the call traces (Vinicius)
> - Explain why the put_device are unnecessary. (Vinicius)
> 
> Yi Sun (2):
>   dmaengine: idxd: Remove improper idxd_free
>   dmaengine: idxd: Fix refcount underflow on module unload
> 
>  drivers/dma/idxd/init.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>

Applied patch series on top of v6.17-rc1 kernel. Issue is fixed.

Please help add Tested-by: Yi Lai <yi1.lai@intel.com>

Regards,
Yi Lai
> -- 
> 2.43.0

Yi Sun <yi.sun@intel.com> writes:

> This patch series addresses two issues related to the device reference
> counting and cleanup path in the idxd driver.
>
> Recent changes introduced improper put_device() calls and duplicated
> cleanup logic, leading to refcount underflow and potential use-after-free
> during module unload.
>
> Patch 1 removes an unnecessary call to idxd_free(), which could result in a
> use-after-free, because the function idxd_conf_device_release already
> covers everything done in idxd_free. The newly added idxd_free in commit
> 90022b3 doesn't resolve any memory leaks, but introduces several duplicated
> cleanup.
>
> Patch 2 refactors the cleanup to avoid redundant put_device() calls
> introduced in commit a409e919ca3. The existing idxd_unregister_devices()
> already handles proper device reference release.
>
> Both patches have been verified on hardware platform.
>
> Both patches have been run through `checkpatch.pl`. Patch 2 gets 1 error
> and 1 warning. But these appear to be limitations in the checkpatch script
> itself, not reflect issues with the patches.
>
> ---

For the series:

Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>


Cheers,
-- 
Vinicius

On 30.07.2025 18:09, Vinicius Costa Gomes wrote:
>Yi Sun <yi.sun@intel.com> writes:
>
>> This patch series addresses two issues related to the device reference
>> counting and cleanup path in the idxd driver.
>>
>> Recent changes introduced improper put_device() calls and duplicated
>> cleanup logic, leading to refcount underflow and potential use-after-free
>> during module unload.
>>
>> Patch 1 removes an unnecessary call to idxd_free(), which could result in a
>> use-after-free, because the function idxd_conf_device_release already
>> covers everything done in idxd_free. The newly added idxd_free in commit
>> 90022b3 doesn't resolve any memory leaks, but introduces several duplicated
>> cleanup.
>>
>> Patch 2 refactors the cleanup to avoid redundant put_device() calls
>> introduced in commit a409e919ca3. The existing idxd_unregister_devices()
>> already handles proper device reference release.
>>
>> Both patches have been verified on hardware platform.
>>
>> Both patches have been run through `checkpatch.pl`. Patch 2 gets 1 error
>> and 1 warning. But these appear to be limitations in the checkpatch script
>> itself, not reflect issues with the patches.
>>
>> ---
>
>For the series:
>
>Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
>
>
>Cheers,
>-- 
>Vinicius

Hi Vinod,

Gentle ping.
This is another series of bug fixes.

Thanks
    --Sun, Yi

On 7/29/25 8:03 AM, Yi Sun wrote:
> This patch series addresses two issues related to the device reference
> counting and cleanup path in the idxd driver.
> 
> Recent changes introduced improper put_device() calls and duplicated
> cleanup logic, leading to refcount underflow and potential use-after-free
> during module unload.
> 
> Patch 1 removes an unnecessary call to idxd_free(), which could result in a
> use-after-free, because the function idxd_conf_device_release already
> covers everything done in idxd_free. The newly added idxd_free in commit
> 90022b3 doesn't resolve any memory leaks, but introduces several duplicated
> cleanup.
> 
> Patch 2 refactors the cleanup to avoid redundant put_device() calls
> introduced in commit a409e919ca3. The existing idxd_unregister_devices()
> already handles proper device reference release.
> 
> Both patches have been verified on hardware platform.
> 
> Both patches have been run through `checkpatch.pl`. Patch 2 gets 1 error
> and 1 warning. But these appear to be limitations in the checkpatch script
> itself, not reflect issues with the patches.

Reviewed-by: Dave Jiang <dave.jiang@intel.com>

for the series

> 
> ---
> Changes in V3:
> - Removed function idxd_disable_sva which got removed recently (Vinicius)
> Changes in v2:
> - Reworded commit messages supplementing the call traces (Vinicius)
> - Explain why the put_device are unnecessary. (Vinicius)
> 
> Yi Sun (2):
>   dmaengine: idxd: Remove improper idxd_free
>   dmaengine: idxd: Fix refcount underflow on module unload
> 
>  drivers/dma/idxd/init.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>