[SRU][R][PATCH 0/2] dmaengine: idxd: fix kdump crash kernel NULL deref / double-free in idxd release path

[Abdur Rahman]

BugLink: https://bugs.launchpad.net/bugs/2163062

SRU Justification:

[Impact]

On systems with Intel DSA/IAA accelerators (the `idxd` driver), the **kdump crash kernel
Oopses with a NULL-pointer dereference in `destroy_workqueue()`**. In the crash kernel the
DSA/IAA devices are HALTED (inherited from the panicked kernel), so idxd probe fails at
device reset before its workqueue is allocated, and `idxd_conf_device_release()` then calls
`destroy_workqueue(NULL)`. The Oops — in a udev worker that exits with IRQs disabled, on the
`nr_cpus=1` crash kernel — wedges the crash kernel: it can no longer finish the vmcore or
reboot, so the host hangs and needs a manual BMC power reset. **Net effect: kdump/vmcore
capture is broken on idxd-equipped hardware.**

Regressing commit (mainline): `3d33de353b1f ("dmaengine: idxd: Fix not releasing workqueue
on .release()")`, which added an unconditional `destroy_workqueue(idxd->wq)` to
`idxd_conf_device_release()`.

Backtrace (full: `idxd-oops.txt`):

idxd 0000:6a:02.0: Intel(R) IDXD DMA Engine init failed
BUG: kernel NULL pointer dereference, address: 00000000000000b8
Oops: 0000 [#1] SMP NOPTI
CPU: 0 ... Comm: (udev-worker) ... 7.0.0-1010-nvidia
Hardware name: NVIDIA DGXH200/DGXH200, BIOS 1.7.8 12/05/2025
RIP: 0010:destroy_workqueue+0x17/0x390
RDI: 0000000000000000 CR2: 00000000000000b8
Call Trace:
idxd_conf_device_release+0x19/0xa0 [idxd]
put_device+0x13/0x30
idxd_pci_probe_alloc+0x285/0x460 [idxd]
idxd_pci_probe+0x16/0x30 [idxd]
...
idxd_init_module+0xd3/0xff0 [idxd]
note: (udev-worker)[1002] exited with irqs disabled

`RDI=0` / `CR2=0xb8` confirm `destroy_workqueue(NULL)`.

Reproducer:

On a system with `idxd` (Intel DSA/IAA) devices and kdump enabled:

echo 1 | sudo tee /proc/sys/kernel/sysrq
echo c | sudo tee /proc/sysrq-trigger

Without the fix: crash kernel Oopses in `destroy_workqueue()`, hangs, no reboot (BMC reset
required). With the fix: no Oops, full vmcore saved, host reboots.

Affected kernels:

Any Ubuntu 7.0 `-generic` / `-nvidia` kernel carrying `3d33de353b1f` (observed on
`linux-nvidia` 7.0, resolute/26.04; `-generic` has the same idxd code).

[Fix]

Two patches from Steve Wahl (HPE), on `dmaengine at vger.kernel.org`, **Acked-by: Vinicius
Costa Gomes** (author of the regression). **Not yet in mainline/linux-next as of August 2026.**

1. **dmaengine: idxd: Do not call destroy_workqueue with null idxd->wq** — `Fixes:
3d33de353b1f` — https://lore.kernel.org/all/20260522203414.336549-1-steve.wahl@hpe.com/
(adds `if (idxd->wq) destroy_workqueue(idxd->wq);`)
2. **dmaengine: idxd: fix duplicate memory frees on initialization error path** — patch 2/2
of the same series (removes a latent double-free on the `idxd_alloc()`/`idxd_free()`
error unwind).

[Test Plan]

Compile and boot tested.

[Where problems could occur]

Low, confined to idxd probe/error paths: patch 1 only NULL-checks before
`destroy_workqueue()` (no change when the workqueue exists); patch 2 removes double frees
already handled by the release callback. No effect on the normal (non-error) path.

Steve Wahl (2):
  UBUNTU: SAUCE: dmaengine: idxd: Do not call destroy_workqueue with
    null idxd->wq
  UBUNTU: SAUCE: dmaengine: idxd: fix duplicate memory frees on
    initialization error path.

 drivers/dma/idxd/init.c  | 10 ++++++----
 drivers/dma/idxd/sysfs.c |  3 ++-
 2 files changed, 8 insertions(+), 5 deletions(-)

-- 
2.53.0