kernel.git/drivers/dma/idxd, branch linux-6.18.y

dmaengine: idxd: fix device leaks on compat bind and unbind

2026-01-23T10:21:33Z

commit 799900f01792cf8b525a44764f065f83fcafd468 upstream. Make sure to drop the reference taken when looking up the idxd device as part of the compat bind and unbind sysfs interface. Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode") Cc: stable@vger.kernel.org # 5.15 Cc: Dave Jiang Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251117161258.10679-7-johan@kernel.org Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman

Merge tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

2025-10-06T17:37:06Z

Pull dmaengine updates from Vinod Koul: "A couple of new device support and small driver updates for this round. New support: - Intel idxd Wildcat Lake family support - SpacemiT K1 PDMA controller support - Renesas RZ/G3E family support Updates: - Xilinx shutdown support and dma client properties update - Designware edma callback_result support" * tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dt-bindings: dma: rz-dmac: Document RZ/G3E family of SoCs dmaengine: dw-edma: Set status for callback_result dmaengine: mv_xor: match alloc_wc and free_wc dmaengine: mmp_pdma: Add SpacemiT K1 PDMA support with 64-bit addressing dmaengine: mmp_pdma: Add operations structure for controller abstraction dmaengine: mmp_pdma: Add reset controller support dmaengine: mmp_pdma: Add clock support dt-bindings: dma: Add SpacemiT K1 PDMA controller dt-bindings: dmaengine: xilinx_dma: Remove DMA client properties dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation dmaengine: xilinx_dma: Support descriptor setup from dma_vecs dmaengine: sh: setup_xref error handling dmaengine: Replace zero-length array with flexible-array dmaengine: ppc4xx: Remove space before newline dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family platforms dmaengine: idxd: Replace memset(0) + strscpy() with strscpy_pad() dt-bindings: dma: nvidia,tegra20-apbdma: Add undocumented compatibles and "clock-names" dmaengine: zynqmp_dma: Add shutdown operation support

Merge tag 'vfio-v6.18-rc1' of https://github.com/awilliam/linux-vfio

2025-10-04T15:24:54Z

Pull VFIO updates from Alex Williamson: - Use fdinfo to expose the sysfs path of a device represented by a vfio device file (Alex Mastro) - Mark vfio-fsl-mc, vfio-amba, and the reset functions for vfio-platform for removal as these are either orphaned or believed to be unused (Alex Williamson) - Add reviewers for vfio-platform to save it from also being marked for removal (Mostafa Saleh, Pranjal Shrivastava) - VFIO selftests, including basic sanity testing and minimal userspace drivers for testing against real hardware. This is also expected to provide integration with KVM selftests for KVM-VFIO interfaces (David Matlack, Josh Hilke) - Fix drivers/cdx and vfio/cdx to build without CONFIG_GENERIC_MSI_IRQ (Nipun Gupta) - Fix reference leak in hisi_acc (Miaoqian Lin) - Use consistent return for unsupported device feature (Alex Mastro) - Unwind using the correct memory free callback in vfio/pds (Zilin Guan) - Use IRQ_DISABLE_LAZY flag to improve handling of pre-PCI2.3 INTx and resolve stalled interrupt on ppc64 (Timothy Pearson) - Enable GB300 in nvgrace-gpu vfio-pci variant driver (Tushar Dave) - Misc: - Drop unnecessary ternary conversion in vfio/pci (Xichao Zhao) - Grammatical fix in nvgrace-gpu (Morduan Zang) - Update Shameer's email address (Shameer Kolothum) - Fix document build warning (Alex Williamson) * tag 'vfio-v6.18-rc1' of https://github.com/awilliam/linux-vfio: (48 commits) vfio/nvgrace-gpu: Add GB300 SKU to the devid table vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices vfio/pds: replace bitmap_free with vfree vfio: return -ENOTTY for unsupported device feature hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_init vfio/platform: Mark reset drivers for removal vfio/amba: Mark for removal MAINTAINERS: Add myself as VFIO-platform reviewer MAINTAINERS: Add myself as VFIO-platform reviewer docs: proc.rst: Fix VFIO Device title formatting vfio: selftests: Fix .gitignore for already tracked files vfio/cdx: update driver to build without CONFIG_GENERIC_MSI_IRQ cdx: don't select CONFIG_GENERIC_MSI_IRQ MAINTAINERS: Update Shameer Kolothum's email address vfio: selftests: Add a script to help with running VFIO selftests vfio: selftests: Make iommufd the default iommu_mode vfio: selftests: Add iommufd mode vfio: selftests: Add iommufd_compat_type1{,v2} modes vfio: selftests: Add vfio_type1v2_mode vfio: selftests: Replicate tests across all iommu_modes ...

dmaengine: idxd: Allow registers.h to be included from tools/

2025-08-27T18:14:08Z

Allow drivers/dma/idxd/registers.h to be included from userspace in tools/ by adjusting the include path to uapi/linux/idxd.h if __KERNEL__ is not defined. A subsequent commit will use registers.h to implement a userspace driver for Intel DSA devices in tools/testing/selftests/vfio. Acked-by: Vinicius Costa Gomes Acked-by: Shuah Khan Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250822212518.4156428-22-dmatlack@google.com Signed-off-by: Alex Williamson

dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family platforms

2025-08-20T17:34:14Z

A new IAA device ID, 0xfd2d, is introduced across all Wildcat Lake family platforms. Add the device ID to the IDXD driver. Signed-off-by: Anil S Keshavamurthy Signed-off-by: Vinicius Costa Gomes Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20250801215936.188555-1-vinicius.gomes@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Fix double free in idxd_setup_wqs()

2025-08-20T17:32:04Z

The clean up in idxd_setup_wqs() has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are: 1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when "conf_dev" hasn't been initialized. 2) If kzalloc_node() fails then again "conf_dev" is invalid. It's either uninitialized or it points to the "conf_dev" from the previous iteration so it leads to a double free. It's better to free partial loop iterations within the loop and then the unwinding at the end can handle whole loop iterations. I also renamed the labels to describe what the goto does and not where the goto was located. Fixes: 3fd2f4bc010c ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs") Reported-by: Colin Ian King Closes: https://lore.kernel.org/all/20250811095836.1642093-1-colin.i.king@gmail.com/ Signed-off-by: Dan Carpenter Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/aJnJW3iYTDDCj9sk@stanley.mountain Signed-off-by: Vinod Koul

dmaengine: idxd: Replace memset(0) + strscpy() with strscpy_pad()

2025-08-20T17:31:27Z

Replace memset(0) followed by strscpy() with strscpy_pad() to improve idxd_load_iaa_device_defaults(). This avoids zeroing the memory before copying the strings and ensures the destination buffers are only written to once, simplifying the code and improving efficiency. Signed-off-by: Thorsten Blum Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20250810225858.2953-2-thorsten.blum@linux.dev Signed-off-by: Vinod Koul

dmaengine: idxd: Fix refcount underflow on module unload

2025-08-20T17:29:58Z

A recent refactor introduced a misplaced put_device() call, resulting in a reference count underflow during module unload. There is no need to add additional put_device() calls for idxd groups, engines, or workqueues. Although the commit claims: "Note, this also fixes the missing put_device() for idxd groups, engines, and wqs." It appears no such omission actually existed. The required cleanup is already handled by the call chain: idxd_unregister_devices() -> device_unregister() -> put_device() Extend idxd_cleanup() to handle the remaining necessary cleanup and remove idxd_cleanup_internals(), which duplicates deallocation logic for idxd, engines, groups, and workqueues. Memory management is also properly handled through the Linux device model. Fixes: a409e919ca32 ("dmaengine: idxd: Refactor remove call with idxd_cleanup() helper") Signed-off-by: Yi Sun Tested-by: Shuai Xue Reviewed-by: Dave Jiang Acked-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20250729150313.1934101-3-yi.sun@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Remove improper idxd_free

2025-08-20T17:29:58Z

The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... Call Trace: idxd_remove+0xe4/0x120 [idxd] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x197/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x74/0xf0 pci_unregister_driver+0x2e/0xb0 idxd_exit_module+0x34/0x7a0 [idxd] __do_sys_delete_module.constprop.0+0x183/0x280 do_syscall_64+0x54/0xd70 entry_SYSCALL_64_after_hwframe+0x76/0x7e The idxd_unregister_devices() which is invoked at the very beginning of idxd_remove(), already takes care of the necessary put_device() through the following call path: idxd_unregister_devices() -> device_unregister() -> put_device() In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is called immediately after, it can result in a use-after-free. Remove the improper idxd_free() to avoid both the refcount underflow and potential memory corruption during module unload. Fixes: d5449ff1b04d ("dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call") Signed-off-by: Yi Sun Tested-by: Shuai Xue Reviewed-by: Dave Jiang Acked-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20250729150313.1934101-2-yi.sun@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Remove __packed from structures

2025-06-27T17:54:25Z

The __packed attribute introduces potential unaligned memory accesses and endianness portability issues. Instead of relying on compiler-specific packing, it's much better to explicitly fill structure gaps using padding fields, ensuring natural alignment. Since all previously __packed structures already enforce proper alignment through manual padding, the __packed qualifiers are unnecessary and can be safely removed. Signed-off-by: Yi Sun Reviewed-by: Andy Shevchenko Reviewed-by: Dave Jiang Reviewed-by: Fenghua Yu Link: https://lore.kernel.org/r/20250404053614.3096769-1-yi.sun@intel.com Signed-off-by: Vinod Koul