Re: [PATCH 1/2] dmaengine: idxd: fix double free in idxd_free()

[Frank Li]

On Wed, Oct 28, 2026 at 12:37:06AM +0000, Jingyi Li wrote:
> [You don't often get email from jinli@xxxxxxxxxxxxxxx. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> idxd_free() calls put_device() on the conf device, which drops the last
> reference and runs idxd_conf_device_release(). The release callback
> already frees idxd->opcap_bmap, the IDA id and idxd itself, so the
> subsequent bitmap_free(), ida_free() and kfree() in idxd_free() operate
> on freed memory.
>
> idxd_free() is called from the error path of idxd_pci_probe_alloc()
> when idxd_probe() fails, for example when the device reports HALTED
> after reset. We hit this in a kdump crash kernel, where the DSA device
> fails to reset: the double free corrupts the slab and the crash kernel
> dies before the dump is saved. With slub_debug=FZPU it shows up as
> general protection faults on 0x6b6b6b6b6b6b6b6b.
>
> Let the release callback do all the freeing.
>
> Fixes: 90022b3a6981 ("dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jingyi Li <jinli@xxxxxxxxxxxxxxx>
> ---

Similar fixes at
https://patchwork.kernel.org/project/linux-dmaengine/patch/20261012-wt-idxd-fixes-v1-2-30a35a445077@xxxxxxxxx/

Frank
>  drivers/dma/idxd/init.c | 3 ---
>  1 file changed, 3 deletions(-)
>
> diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
> index 4b827a329756..1577d22b299c 100644
> --- a/drivers/dma/idxd/init.c
> +++ b/drivers/dma/idxd/init.c
> @@ -581,9 +581,6 @@ static void idxd_free(struct idxd_device *idxd)
>                 return;
>
>         put_device(idxd_confdev(idxd));
> -       bitmap_free(idxd->opcap_bmap);
> -       ida_free(&idxd_ida, idxd->id);
> -       kfree(idxd);
>  }
>
>  static struct idxd_device *idxd_alloc(struct pci_dev *pdev, struct idxd_driver_data *data)
> --
> 2.43.0
>