Re: [PATCH v1] dmaengine: idxd: fix deadlock and double free in idxd_cdev_open()

[Frank Li]

On Thu, Apr 16, 2026 at 06:19:57PM -0400, Yuho Choi wrote:
> The failed_dev_add and failed_dev_name error paths in idxd_cdev_open()
> call put_device(fdev) while still holding wq->wq_lock. This triggers
> idxd_file_dev_release() synchronously, which calls
> mutex_lock(&wq->wq_lock) — deadlocking on the same mutex.
>
> Additionally, the original code fell through from failed_dev_add and
> failed_dev_name to the failed: label, which called kfree(ctx) a second
> time after idxd_file_dev_release() had already freed it. The subsequent
> idxd_xa_pasid_remove(ctx) then uses the freed pointer.
>
> Fix both issues by releasing wq_lock before put_device(fdev) and
> returning immediately, so the release callback acquires the lock without
> contention and no further cleanup is attempted on the freed context.
>
> Fixes: e6fd6d7e5f0fe ("dmaengine: idxd: add a device to represent the file opened")
> Signed-off-by: Yuho Choi <dbgh9129@xxxxxxxxx>
> ---
>  drivers/dma/idxd/cdev.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
> index 0366c7cf35020..19a449333782b 100644
> --- a/drivers/dma/idxd/cdev.c
> +++ b/drivers/dma/idxd/cdev.c
> @@ -307,7 +307,9 @@ static int idxd_cdev_open(struct inode *inode, struct file *filp)
>
>  failed_dev_add:
>  failed_dev_name:
> +	mutex_unlock(&wq->wq_lock);

Can you use auto cleanup to fix this problem?

Frank

>  	put_device(fdev);
> +	return rc;
>  failed_ida:
>  failed_set_pasid:
>  	if (device_user_pasid_enabled(idxd))
> --
> 2.50.1 (Apple Git-155)
>