[PATCH 02/17] dmaengine: idxd: detach the user fault workqueue under the event log lock

[Daniel Byrne]

The event log walk tests wq->wq and queues fault work on it, and the
drain of a closing context's PASID tests it and drains it, both under
evl->lock. The user driver's remove destroyed the workqueue without
that lock, so a walk could queue on a workqueue being destroyed, and
the probe's error path destroyed it without clearing the pointer, so a
later walk or drain found a dangling one.

Detach and destroy the workqueue under evl->lock, in one helper that
the remove and the probe error path share, and clear the pointer in
both. A walk or a drain that finds it gone knows that the fault work
it would have waited for has run.

Assisted-by: Claude:claude-opus-5-5
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Daniel Byrne <daniel1.byrne@xxxxxxxxx>
---
 drivers/dma/idxd/cdev.c | 27 ++++++++++++++++++++++-----
 drivers/dma/idxd/irq.c  |  5 ++++-
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
index 82b07cf942ef..168888adccac 100644
--- a/drivers/dma/idxd/cdev.c
+++ b/drivers/dma/idxd/cdev.c
@@ -592,6 +592,26 @@ void idxd_wq_del_cdev(struct idxd_wq *wq)
 	put_device(cdev_dev(idxd_cdev));
 }
 
+/*
+ * The event log walk tests the fault workqueue and queues on it, and the
+ * drain of a closing context's PASID tests it and drains it, both under
+ * the log's lock, which neither the probe nor the remove otherwise takes.
+ * The workqueue is therefore detached and destroyed under that lock. A
+ * walk or a drain that finds it gone knows that its work has run.
+ */
+static void idxd_user_wq_destroy_fault_wq(struct idxd_wq *wq)
+{
+	struct idxd_evl *evl = wq->idxd->evl;
+
+	if (evl)
+		mutex_lock(&evl->lock);
+	wq->type = IDXD_WQT_NONE;
+	destroy_workqueue(wq->wq);
+	wq->wq = NULL;
+	if (evl)
+		mutex_unlock(&evl->lock);
+}
+
 static int idxd_user_drv_probe(struct idxd_dev *idxd_dev)
 {
 	struct device *dev = &idxd_dev->conf_dev;
@@ -653,8 +673,7 @@ static int idxd_user_drv_probe(struct idxd_dev *idxd_dev)
 err_cdev:
 	idxd_drv_disable_wq(wq);
 err:
-	destroy_workqueue(wq->wq);
-	wq->type = IDXD_WQT_NONE;
+	idxd_user_wq_destroy_fault_wq(wq);
 wq_err:
 	mutex_unlock(&wq->wq_lock);
 	return rc;
@@ -667,9 +686,7 @@ static void idxd_user_drv_remove(struct idxd_dev *idxd_dev)
 	mutex_lock(&wq->wq_lock);
 	idxd_wq_del_cdev(wq);
 	idxd_drv_disable_wq(wq);
-	wq->type = IDXD_WQT_NONE;
-	destroy_workqueue(wq->wq);
-	wq->wq = NULL;
+	idxd_user_wq_destroy_fault_wq(wq);
 	mutex_unlock(&wq->wq_lock);
 }
 
diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c
index 820b1ff69fb6..647969920a06 100644
--- a/drivers/dma/idxd/irq.c
+++ b/drivers/dma/idxd/irq.c
@@ -339,7 +339,10 @@ static void process_evl_entry(struct idxd_device *idxd,
 			 * PASID xarray, which is populated by cdev opens
 			 * alone. A kernel WQ has no cdev workqueue and no
 			 * user contexts, so queueing could only warn and
-			 * drop the record. Note it and move on.
+			 * drop the record. Note it and move on. The user
+			 * driver detaches the workqueue under evl->lock,
+			 * which this walk holds, so the one tested here is
+			 * the one queued on.
 			 */
 			if (!is_idxd_wq_user(wq) || !wq->wq) {
 				dev_warn_ratelimited(dev,
-- 
2.43.0