On 11/17/25 9:12 AM, Johan Hovold wrote:
> Make sure to drop the reference taken when looking up the idxd device as
> part of the compat bind and unbind sysfs interface.
>
> Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode")
> Cc: stable@vger.kernel.org # 5.15
> Cc: Dave Jiang <dave.jiang@intel.com>
> Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>> ---
> drivers/dma/idxd/compat.c | 23 +++++++++++++++++++----
> 1 file changed, 19 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/dma/idxd/compat.c b/drivers/dma/idxd/compat.c
> index eff9943f1a42..95b8ef958633 100644
> --- a/drivers/dma/idxd/compat.c
> +++ b/drivers/dma/idxd/compat.c
> @@ -20,11 +20,16 @@ static ssize_t unbind_store(struct device_driver *drv, const char *buf, size_t c
> int rc = -ENODEV;
>
> dev = bus_find_device_by_name(bus, NULL, buf);
> - if (dev && dev->driver) {
> + if (!dev)
> + return -ENODEV;
> +
> + if (dev->driver) {
> device_driver_detach(dev);
> rc = count;
> }
>
> + put_device(dev);
> +
> return rc;
> }
> static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store);
> @@ -38,9 +43,12 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf, size_t cou
> struct idxd_dev *idxd_dev;
>
> dev = bus_find_device_by_name(bus, NULL, buf);
> - if (!dev || dev->driver || drv != &dsa_drv.drv)
> + if (!dev)
> return -ENODEV;
>
> + if (dev->driver || drv != &dsa_drv.drv)
> + goto err_put_dev;
> +
> idxd_dev = confdev_to_idxd_dev(dev);
> if (is_idxd_dev(idxd_dev)) {
> alt_drv = driver_find("idxd", bus);
> @@ -53,13 +61,20 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf, size_t cou
> alt_drv = driver_find("user", bus);
> }
> if (!alt_drv)
> - return -ENODEV;
> + goto err_put_dev;
>
> rc = device_driver_attach(alt_drv, dev);
> if (rc < 0)
> - return rc;
> + goto err_put_dev;
> +
> + put_device(dev);
>
> return count;
> +
> +err_put_dev:
> + put_device(dev);
> +
> + return rc;
> }
> static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store);
>