dmaengine: idxd: Fix possible invalid memory access after FLR

vcgomes · vinodkoul · commit d6077df7b75d · 2026-02-25T16:39:17.000+05:30
In the case that the first Function Level Reset (FLR) concludes correctly, but in the second FLR the scratch area for the saved configuration cannot be allocated, it's possible for a invalid memory access to happen. Always set the deallocated scratch area to NULL after FLR completes. Fixes: 98d187a ("dmaengine: idxd: Enable Function Level Reset (FLR) for halt") Reviewed-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com> Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-3-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
@@ -1146,6 +1146,7 @@ static void idxd_reset_done(struct pci_dev *pdev)
 	}
 out:
 	kfree(idxd->idxd_saved);
+	idxd->idxd_saved = NULL;
 }
 
 static const struct pci_error_handlers idxd_error_handler = {

Original file line number	Diff line number	Diff line change
`@@ -1146,6 +1146,7 @@ static void idxd_reset_done(struct pci_dev *pdev)`
`1146`	`1146`	`}`
`1147`	`1147`	`out:`
`1148`	`1148`	`kfree(idxd->idxd_saved);`
	`1149`	`+ idxd->idxd_saved = NULL;`
`1149`	`1150`	`}`
`1150`	`1151`
`1151`	`1152`	`static const struct pci_error_handlers idxd_error_handler = {`