[PATCH 01/17] dmaengine: idxd: don't queue EVL fault work for kernel WQs

[Daniel Byrne]

The event log fault path queues work on wq->wq, the workqueue that
only the user (cdev) driver creates for its work queues. A completion
record fault logged for a kernel work queue, as a dmaengine or
iaa_crypto queue is, finds that pointer NULL and queue_work()
dereferences it.

The fault worker only serves user contexts: it copies the completion
record through the PASID xarray that cdev opens populate. On a kernel
work queue there is nothing to do, so log the entry ratelimited and
drop it. Test the queue's type and not the pointer alone, since a user
probe that failed leaves the pointer dangling.

Fixes: c40bd7d9737b ("dmaengine: idxd: process user page faults for completion record")
Cc: stable@xxxxxxxxxxxxxxx # 6.4+
Assisted-by: Claude:claude-opus-5-5
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Daniel Byrne <daniel1.byrne@xxxxxxxxx>
---
 drivers/dma/idxd/irq.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c
index 6a25e1fd0e62..820b1ff69fb6 100644
--- a/drivers/dma/idxd/irq.c
+++ b/drivers/dma/idxd/irq.c
@@ -331,10 +331,25 @@ static void process_evl_entry(struct idxd_device *idxd,
 			if (!entry_head->rcr && status == DSA_COMP_DRAIN_EVL)
 				return;
 
+			struct idxd_wq *wq = idxd->wqs[entry_head->wq_idx];
+
+			/*
+			 * The fault worker only does user-context work,
+			 * copying the completion record through the wq's
+			 * PASID xarray, which is populated by cdev opens
+			 * alone. A kernel WQ has no cdev workqueue and no
+			 * user contexts, so queueing could only warn and
+			 * drop the record. Note it and move on.
+			 */
+			if (!is_idxd_wq_user(wq) || !wq->wq) {
+				dev_warn_ratelimited(dev,
+					"EVL fault on kernel wq %d, status %#x\n",
+					wq->id, status);
+				return;
+			}
+
 			fault = kmem_cache_alloc(idxd->evl_cache, GFP_ATOMIC);
 			if (fault) {
-				struct idxd_wq *wq = idxd->wqs[entry_head->wq_idx];
-
 				fault->wq = wq;
 				fault->status = status;
 				memcpy(&fault->entry, entry_head, ent_size);
-- 
2.43.0